muapi-logo-creator
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/create-logo.shcalls a core platform toolgenerate-image.shvia a relative path. This execution allows the skill to utilize the system's image generation capabilities. - [INDIRECT_PROMPT_INJECTION]: User-provided brand names and concepts are ingested through script arguments and directly embedded into the instructions sent to the image generation model.
- Ingestion points: The
--brandand--conceptparameters inscripts/create-logo.sh. - Boundary markers: The prompt uses labels like
BRAND_NAME:andICON_CONCEPT:to structure data, but does not employ delimiters to prevent user input from containing additional model instructions. - Capability inventory: The skill can trigger image generation tasks using the platform's Flux model.
- Sanitization: Input values are used directly in string interpolation without escaping or validation.
Audit Metadata