The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates the user-provided material_style input directly into prompts for image and video generation tools.
Ingestion points: The material_style input field defined in SKILL.md is used as a template variable.
Boundary markers: There are no delimiters (like XML tags or triple quotes) or 'ignore embedded instructions' warnings surrounding the {{material_style}} placeholder in the prompts.
Capability inventory: The skill utilizes muapi image edit, muapi video from-image, and curl to execute network-based media generation tasks.
Sanitization: There is no evidence of input validation, escaping, or filtering for the material_style string before it is used to construct tool commands.
[COMMAND_EXECUTION]: The instructions direct the agent to execute muapi CLI commands and potentially fallback to curl for API requests. These commands are consistent with the skill's stated purpose of interacting with the vendor's infrastructure.
[DATA_EXFILTRATION]: The skill mentions the use of MUAPI_API_KEY and provides curl templates that include this key in authorization headers. This is standard practice for authenticating with the vendor's own API service and does not represent an unauthorized exfiltration attempt.

muapi-3d-logo-animation