muapi-drone-style-video
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text for the location, style, and shot type, directly interpolating these strings into a natural language prompt for a video generation model. This creates a surface for indirect prompt injection where a user could attempt to override the model's behavior.
- Ingestion points: User-provided inputs
location_or_subject,shot_type,style, andaspect_ratioinSKILL.md. - Boundary markers: None. Inputs are inserted directly into the prompt templates without delimiters or 'ignore' instructions.
- Capability inventory: The skill executes CLI commands (
muapi video generate) and network requests (curl) to external APIs. - Sanitization: None. There is no evidence of input validation or escaping before the data is used in prompts or commands.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically construct shell commands using the
curlutility and themuapiCLI. It uses template placeholders ({{input_name}}) to insert user data into these commands. Without strict sanitization, this pattern is vulnerable to command injection if a user includes shell metacharacters (e.g., semicolons, backticks, or pipes) in their input.
Audit Metadata