muapi-ai-clipping-cd9b91 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited muapi-ai-clipping-cd9b91 (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One API call: long video in → ranked vertical short clips out.
Each clip ships with a viral score (0–100), an opening hook line, a one-sentence "why it works" reason, and a hosted mp4 URL.
Underlying API: https://muapi.ai/playground/ai-clipping Reference implementation (open source): https://github.com/SamurAIGPT/AI-Youtube-Shorts-Generator
If you only need raw timestamps for your own renderer, set --coords-only to skip cropping and just get the highlight ranges.
| Input | Required | Default | Notes | ||
|---|---|---|---|---|---|
--video | yes | — | Hosted mp4 URL, or local file path (auto-uploaded), or YouTube URL (if backend supports it) | ||
--num-clips | no | 3 | Number of highlights to extract | ||
--aspect-ratio | no | 9:16 | 9:16 \ | 1:1 \ | 4:5 |
--coords-only | no | off | Return just the highlight time ranges, skip cropping |
If the user gave only a video URL, run with defaults — don't block on questions.
muapi-cli installed and authed (muapi auth configure)MUAPI_API_KEY available (env var or muapi auth status passes)That's it. No ffmpeg, no Python, no Whisper install, no LLM keys. Everything runs server-side.
bash library/edit/ai-clipping/scripts/run-ai-clipping.sh \
--video "https://example.com/podcast.mp4" \
--num-clips 5 \
--aspect-ratio 9:16 \
--viewThe script:
--video to a hosted URL (uploads local files via muapi upload file if needed).muapi edit clipping with the supported parameters.request_id immediately under --async).--output-json is set, writes the full result.The /ai-clipping endpoint internally runs the full pipeline so the agent doesn't have to:
This is why the skill is small: the heavy lifting is on the API.
Defaults — three 9:16 clips:
bash run-ai-clipping.sh --video "https://example.com/long.mp4"Podcast — more clips, view in player:
bash run-ai-clipping.sh --video "<URL>" --num-clips 8 --viewSquare clips for Instagram feed:
bash run-ai-clipping.sh --video "<URL>" --aspect-ratio 1:1 --num-clips 3Just the timestamps (build your own renderer):
bash run-ai-clipping.sh --video "<URL>" --coords-only --output-json result.jsonAsync submit (returns request_id, poll later):
REQUEST_ID=$(bash run-ai-clipping.sh --video "<URL>" --async --output-json - | jq -r '.request_id')
muapi predict wait "$REQUEST_ID" --download ./outputsLocal file:
bash run-ai-clipping.sh --video ./recording.mp4 --num-clips 5 --viewBatch — `urls.txt` with one URL per line:
xargs -a urls.txt -I{} bash run-ai-clipping.sh --video "{}"| Platform | Ratio | Sweet-spot duration |
|---|---|---|
| TikTok / Reels / YouTube Shorts | 9:16 | 30–75s |
| Instagram Feed | 1:1 | 15–45s |
| Pinterest / portrait | 4:5 | 30–60s |
Default to 9:16 unless the platform is specified.
{
"source_video_url": "...",
"shorts": [
{
"title": "The one mistake that cost me $50K",
"start_time": 124.3,
"end_time": 187.6,
"score": 92,
"hook_sentence": "Nobody talks about this, but it killed my first startup...",
"virality_reason": "Opens with a number + regret, peaks on a contrarian lesson",
"clip_url": "https://.../short_1.mp4"
}
]
}When --coords-only is set, each entry has start_time/end_time but no clip_url — render locally with ffmpeg.
When reporting back to the user, surface for each clip: rank, score, time range, title, hook, and clip URL.
9:16. Default to that.request_id can be re-fetched with muapi predict wait <id> rather than re-clipping.--poll-timeout) and retry.muapi upload file <path> first, then pass the returned URL.The skill is done when:
result.shorts has up to num_clips entries, each with a working clip_url (or start_time/end_time under --coords-only).--output-json was set, the file exists and parses.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.