muapi-media-editing
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts utilize
curl,jq, andpython3to perform API calls, parse JSON responses, and safely encode user-provided strings for transmission. It also invokes amuapicommand-line utility for image editing tasks. - [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API endpoints at
api.muapi.aito upload media and request AI editing operations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts and transmits them to an external AI processing service, creating a surface for potential indirect instruction injection.
- Ingestion points: User input provided via the
--promptargument inedit-image.sh,enhance-image.sh, andvideo-effects.sh. - Boundary markers: User input is wrapped in JSON using
python3'sjson.dumpsmethod before being sent to the API. - Capability inventory: The skill uses
curlto transmit data to a remote API. - Sanitization: The input is JSON-encoded to prevent malformed payloads, but the semantic content is not filtered before being processed by the destination AI model.
Audit Metadata