muapi-audio
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
create-music.shexecutes local system commands includingcurlfor API interaction andpython3for secure string processing. - [EXTERNAL_DOWNLOADS]: The skill communicates with
api.muapi.aito submit generation requests and retrieve results. It also supports processing remote audio and video URLs fromcdn.muapi.aifor remixing and audio extraction tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for music styles and descriptions, which are then passed to external AI models.
- Ingestion points: The
--promptand--stylearguments increate-music.sh(referenced inSKILL.md). - Boundary markers: The script employs
python3to JSON-encode input strings, preventing character-based injection into the API request structure. - Capability inventory: Limited to network requests (
curl) to the vendor's official API infrastructure. - Sanitization: Input data is programmatically escaped via standard JSON serialization before transmission.
- [SAFE]: The skill implements secret management by storing API keys in a
.envfile via the--add-keycommand, which is an industry-standard practice for avoiding hardcoded credentials.
Audit Metadata