muapi-action-figure-generator

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions guide the agent to perform operations using the muapi command-line interface, including muapi image edit for generation and muapi auth configure for setup.- [COMMAND_EXECUTION]: The instructions include a fallback using curl to make POST requests to the Muapi API endpoint at https://api.muapi.ai/api/v1/ for model invocation and status polling.- [INDIRECT_PROMPT_INJECTION]: User-provided text from the toy_theme input is interpolated directly into the image generation prompt, creating a potential surface for influencing the generated output.
  • Ingestion points: The toy_theme variable within SKILL.md is used to customize the character's outfit.
  • Boundary markers: The prompt template lacks specific delimiters or instructions to ignore potential commands embedded within the toy_theme string.
  • Capability inventory: The skill utilizes shell command execution (muapi CLI) and network requests (curl) as described in SKILL.md.
  • Sanitization: No input validation or escaping is applied to the user-supplied text before it is inserted into the final prompt string.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:15 PM