The Agent Skills Directory

[SAFE]: The skill provides legitimate integration with the muapi.ai AI generation platform, enabling text-to-image and video-to-video workflows through standardized API calls.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection via user-controlled input.
Ingestion points: User-provided prompts and file paths in generate-image.sh, generate-video.sh, image-to-video.sh, and upload.sh.
Boundary markers: Absent; there are no specific markers or instructions to isolate untrusted content.
Capability inventory: Network communication via curl and file read operations for uploads in upload.sh and image-to-video.sh.
Sanitization: Present; the scripts use python3 to escape prompt content before inclusion in JSON payloads.
[COMMAND_EXECUTION]: The skill executes shell commands using curl and python3. All user-derived variables are handled through safe interpolation or sanitization to prevent command injection.
[DATA_EXFILTRATION]: The skill supports uploading local files to a remote CDN at muapi.ai. While this is an intended feature for media processing, it allows the agent to transfer local file data to an external service.
[CREDENTIALS_UNSAFE]: No hardcoded API keys were found. The skill manages authentication via a local .env file, which is a standard security practice for local agent skills.

muapi-generate