muapi-animal-video-generator
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user inputs (‘animal_type’, ‘location’, ‘clothing’, ‘script’) and interpolates them directly into prompts for image and video generation without boundary markers or sanitization.
- Ingestion points: Inputs defined in the SKILL.md file.
- Boundary markers: Absent in the generative prompts.
- Capability inventory: Executes muapi CLI commands and curl network operations.
- Sanitization: None described for prompt interpolation.
- [COMMAND_EXECUTION]: The instructions direct the agent to construct and execute shell commands (muapi and curl) by substituting placeholders with user-supplied strings. This creates a surface for command injection if the agent does not properly sanitize these inputs before execution.
- [DATA_EXFILTRATION]: The skill performs network operations using curl to api.muapi.ai. While this is for its primary function, the domain is not among the whitelisted services, qualifying it as a network communication finding.
Audit Metadata