feat: add MuAPI media generation skill

[Anil-matcha]

Summary

Adds skills/muapi-media/SKILL.md, an instruction-only skill for safe MuAPI image and video generation workflows.

The skill covers:

• live model and schema discovery before constructing requests;
• explicit approval before billable generation requests;
• bounded polling and request-ID recovery;
• header-free HTTPS output downloads; and
• source-only contribution guidance without generated catalog changes.

Change Classification

• Skill PR
• Docs PR
• Infra PR

Quality Bar Checklist ✅

• Standards: I reviewed the contributor quality and security guidance.
• Metadata: The SKILL.md frontmatter passes npm run validate.
• Risk Label: The skill is labeled risk: safe.
• Triggers: The When to Use section is explicit and task-oriented.
• Limitations: The skill includes a ## Limitations section.
• Security: The network, key-handling, polling, and download guidance passed npm run security:docs.
• Automated Skill Review: I will monitor the skill-review check and address actionable feedback.
• Manual Logic Review: I reviewed the request flow, approval boundary, failure modes, and safety label.
• Local Test: I ran the repository validation and evidence checks for the source-only skill.
• Repo Checks: npm run validate:references passed.
• Source-Only PR: This PR adds only skills/muapi-media/SKILL.md; generated registry artifacts are omitted.
• Credits: No external source credit is applicable to this original skill.
• License provenance: This skill is original content and does not import an external source repository.
• Maintainer Edits: Allow edits from maintainers is enabled on this PR.

Validation

• npm run validate — passed.
• npm run validate:references — passed.
• npm run security:docs — passed with no findings.
• npm run pr:preflight -- --no-run --json — source-only, no derived changes.
• npm run pr:evidence -- --base origin/main --head HEAD — one added skill, zero audit warnings/errors.

The repository's CI refreshes generated indexes before its full test contract; this contribution intentionally contains no generated files.

Additional Resources

• MuAPI API reference
• MuAPI AI video API

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20ecba8966

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Classify billable state-changing generation as critical

Users installing only --risk safe,none would receive this skill even though it creates billable remote generation jobs and writes downloaded media. The repository's classification in docs/contributors/quality-bar.md reserves safe for read-only/non-destructive commands and assigns state-modifying operations to critical; explicit confirmation reduces execution risk but does not make the capability read-only, so this should be labeled risk: critical.

AGENTS.md reference: AGENTS.md:L52-L54

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the API key out of curl's argument vector

On shared hosts or systems that collect process command lines, expanding $MUAPI_API_KEY directly into --header exposes the billable credential through curl's argv for every POST and polling request (the same pattern recurs at line 171). curl --help all documents --header <header/@file> and --config <file>; pass a protected header source or a config through stdin instead so the key remains out of process listings.

AGENTS.md reference: AGENTS.md:L52-L54

Useful? React with 👍 / 👎.