The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts execute standard system utilities including curl for interacting with the muapi.ai API, jq for parsing JSON responses and local schema files, and python3 for sanitizing string inputs.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to api.muapi.ai to submit generation requests, poll for status, and download final media assets. In generate-image.sh and generate-video.sh, files are downloaded to a media_outputs directory and opened using the system's default viewer.
[DATA_EXFILTRATION]: Local files provided as input (e.g., via --file or --audio-file) are uploaded to the muapi.ai service via curl -F "file=@${FPATH}". This is the intended behavior for providing source media to the AI models.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface where instructions could be embedded in the prompts or styles processed by the agent.
Ingestion points: User-supplied strings via --prompt and --style arguments in all generation scripts.
Boundary markers: Prompts are not wrapped in delimiters when sent to the API, although they are JSON-encoded.
Capability inventory: The skill has network access (curl) and file upload capabilities.
Sanitization: Inputs are passed through python3 -c 'import json...' to ensure they are valid JSON strings, which prevents breaking the API request structure but does not filter semantic injection content.

muapi-media-generation