muapi-ai-clipping

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external video sources via an API and presents the resulting metadata to the agent and user. A maliciously crafted video could potentially influence agent behavior through the returned title, hook, or virality reason.
  • Ingestion points: API response stored in RAW_RESULT in scripts/run-ai-clipping.sh and later parsed by jq.
  • Boundary markers: No specific delimiters or warnings are used when interpolating API-returned strings into the agent's output context.
  • Capability inventory: The skill possesses the ability to execute shell commands, perform network operations (uploads/downloads), and write files to the local system.
  • Sanitization: No sanitization or validation is applied to the metadata strings (titles, hooks, reasons) returned by the service before display.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the muapi-cli package, which it instructs the user to install via npm. It also performs network requests to muapi.ai for video processing and file uploads.
  • [COMMAND_EXECUTION]: The skill executes shell commands using a wrapper script scripts/run-ai-clipping.sh. It invokes system tools including bash, jq, and the muapi CLI to perform its tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:15 PM