muapi-social-pack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited muapi-social-pack (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Re-render a hero image into Instagram, TikTok, YouTube-shorts and Twitter/X aspect ratios.
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
source_image | image_url | yes | — | URL of the hero image (or asset_id from this session). |
caption_idea | text | no | — | Optional caption / overlay direction (kept short). |
formats | list | no | 1:1, 9:16, 4:5, 16:9 | Aspect ratios to produce. |
Use the plan to fan out one node per format.
{{formats}}:muapi image edit (model=nano-banana-2-edit) with the source image.Keep the subject centred and uncropped. Match the original lighting and palette. {{caption_idea_hint}}".
{{caption_idea_hint}} = "Leave headroom at the top for acaption: '<caption_idea>'." (only if caption_idea is non-empty).
original asset id for it.
social pack, resize for social, cross-post, multi-platform
muapi CLI commands. Use muapi auth configure first if MUAPI_API_KEY is unset.curl -X POST https://api.muapi.ai/api/v1/<endpoint> -H "x-api-key: $MUAPI_API_KEY" -H 'content-type: application/json' -d '{...}' and poll with muapi predict wait <request_id>.{{input_name}} placeholders with the user's actual inputs before issuing each call.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.