The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via the scene and style input fields and interpolates them directly into prompts (e.g., {{scene}}, one continuous uncut shot... {{style}}) without sanitization or delimiters. This creates an attack surface where malicious input could influence agent behavior.
Ingestion points: scene and style variables in SKILL.md.
Boundary markers: None present; inputs are directly concatenated into the prompt string.
Capability inventory: Shell execution via muapi CLI and curl.
Sanitization: None observed in the provided instructions.
[COMMAND_EXECUTION]: The skill relies on shell commands including muapi video generate and curl to interact with remote APIs.
[DATA_EXFILTRATION]: The skill instructs the agent to use the MUAPI_API_KEY environment variable to authenticate requests to https://api.muapi.ai. While this is consistent with the skill's primary purpose and the author's infrastructure, it involves the handling and transmission of sensitive credentials.

muapi-one-shot-video