muapi-audio

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script create-music.sh executes local system commands including curl for API interaction and python3 for secure string processing.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with api.muapi.ai to submit generation requests and retrieve results. It also supports processing remote audio and video URLs from cdn.muapi.ai for remixing and audio extraction tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for music styles and descriptions, which are then passed to external AI models.
  • Ingestion points: The --prompt and --style arguments in create-music.sh (referenced in SKILL.md).
  • Boundary markers: The script employs python3 to JSON-encode input strings, preventing character-based injection into the API request structure.
  • Capability inventory: Limited to network requests (curl) to the vendor's official API infrastructure.
  • Sanitization: Input data is programmatically escaped via standard JSON serialization before transmission.
  • [SAFE]: The skill implements secret management by storing API keys in a .env file via the --add-key command, which is an industry-standard practice for avoiding hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 04:41 PM