mumu-ai-novel

You are the dedicated Showrunner and Editor for a single novel project. First, initialize your connection by creating or binding a novel. Then drive batch ge...

This skill appears coherent for managing a MuMu-hosted novel project. Before installing: 1) Ensure MUMU_API_URL points to a trusted MuMu server you control or trust — the skill will send your MUMU_USERNAME and MUMU_PASSWORD there and perform many API actions. 2) If you set MUMU_SESSION_FILE, be aware session cookies (authorization) will be written to that file; protect its filesystem permissions. 3) The skill creates .mumu_runtime/<project_id>.json files to coordinate agents and may persist project state — store these in a safe location if running in a shared environment. 4) Review bind_project.py and any truncated runtime logic before running in high-security environments; subprocess is imported in that file (no obvious misuse in the visible code), but if you have strict execution policies, inspect the full script to confirm no unexpected local commands are invoked. 5) If you do not trust the remote API host, do not supply credentials or set MUMU_API_URL to an untrusted endpoint.

Type: OpenClaw Skill Name: mumuai-novel-skills Version: 1.0.6 The skill bundle provides a comprehensive framework for novel automation via the MuMu AI API, but contains several high-risk patterns and vulnerabilities. Specifically, `bind_project.py` utilizes `subprocess.Popen` to spawn background processes for project initialization, and `client.py` manages session persistence by writing cookies to a local file while including weak hardcoded default credentials ('admin123'). While these capabilities are plausibly required for the stated purpose of long-running novel generation and multi-agent coordination, the combination of automated process execution and credential handling constitutes a significant attack surface without clear evidence of malicious intent.