MuPiBox Media DB

Manage the MuPiBox media database via backend API to list, add, remove, move, edit, and restore media entries stored in data.json.

This skill appears to do exactly what it says: manage a MuPiBox media DB via the MuPiBox backend. Before installing or running it, confirm you actually run (or trust) the MuPiBox service at the base URL you will provide. Be aware the script will create backups under ~/.mupibox-db-backups (ensure you have space and that you trust the backup/restore files). Because the skill can be invoked by the agent, avoid enabling it for autonomous use unless you want the agent to be able to add/edit/delete entries on that backend. If you do not run a MuPiBox instance, there is no need to install this skill.

Type: OpenClaw Skill Name: mupibox-media-db Version: 1.0.2 The skill bundle is classified as suspicious due to its capabilities for network requests to a user-controlled base URL and file system operations (reading arbitrary JSON files for restore). While these features are necessary for the skill's stated purpose of managing a MuPiBox media database, they introduce potential vulnerabilities such as Server-Side Request Forgery (SSRF) if the `--base-url` argument is not properly sanitized, or data injection/integrity issues if the `--file` argument for restore points to an untrusted or malicious JSON file. The `SKILL.md` documentation attempts to mitigate this by instructing the agent to 'Restore only from trusted backup files', but the underlying code in `scripts/mupibox_media_manager.py` provides the capability for these actions without inherent input validation beyond basic type checks.