muapi-drone-style-video

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text for the location, style, and shot type, directly interpolating these strings into a natural language prompt for a video generation model. This creates a surface for indirect prompt injection where a user could attempt to override the model's behavior.
  • Ingestion points: User-provided inputs location_or_subject, shot_type, style, and aspect_ratio in SKILL.md.
  • Boundary markers: None. Inputs are inserted directly into the prompt templates without delimiters or 'ignore' instructions.
  • Capability inventory: The skill executes CLI commands (muapi video generate) and network requests (curl) to external APIs.
  • Sanitization: None. There is no evidence of input validation or escaping before the data is used in prompts or commands.
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically construct shell commands using the curl utility and the muapi CLI. It uses template placeholders ({{input_name}}) to insert user data into these commands. Without strict sanitization, this pattern is vulnerable to command injection if a user includes shell metacharacters (e.g., semicolons, backticks, or pipes) in their input.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:15 PM