muapi-action-figure-generator
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions guide the agent to perform operations using the
muapicommand-line interface, includingmuapi image editfor generation andmuapi auth configurefor setup.- [COMMAND_EXECUTION]: The instructions include a fallback usingcurlto make POST requests to the Muapi API endpoint athttps://api.muapi.ai/api/v1/for model invocation and status polling.- [INDIRECT_PROMPT_INJECTION]: User-provided text from thetoy_themeinput is interpolated directly into the image generation prompt, creating a potential surface for influencing the generated output. - Ingestion points: The
toy_themevariable withinSKILL.mdis used to customize the character's outfit. - Boundary markers: The prompt template lacks specific delimiters or instructions to ignore potential commands embedded within the
toy_themestring. - Capability inventory: The skill utilizes shell command execution (
muapiCLI) and network requests (curl) as described inSKILL.md. - Sanitization: No input validation or escaping is applied to the user-supplied text before it is inserted into the final prompt string.
Audit Metadata