muapi-ai-clipping
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external video sources via an API and presents the resulting metadata to the agent and user. A maliciously crafted video could potentially influence agent behavior through the returned title, hook, or virality reason.
- Ingestion points: API response stored in
RAW_RESULTinscripts/run-ai-clipping.shand later parsed byjq. - Boundary markers: No specific delimiters or warnings are used when interpolating API-returned strings into the agent's output context.
- Capability inventory: The skill possesses the ability to execute shell commands, perform network operations (uploads/downloads), and write files to the local system.
- Sanitization: No sanitization or validation is applied to the metadata strings (titles, hooks, reasons) returned by the service before display.
- [EXTERNAL_DOWNLOADS]: The skill relies on the
muapi-clipackage, which it instructs the user to install vianpm. It also performs network requests tomuapi.aifor video processing and file uploads. - [COMMAND_EXECUTION]: The skill executes shell commands using a wrapper script
scripts/run-ai-clipping.sh. It invokes system tools includingbash,jq, and themuapiCLI to perform its tasks.
Audit Metadata