muapi-platform

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts setup.sh and check-result.sh function as wrappers for an external muapi command-line utility. They pass user-supplied arguments, including API keys and request IDs, to this tool to perform authentication and data retrieval from the muapi.ai platform.
  • [INDIRECT_PROMPT_INJECTION]: The check-result.sh script facilitates the processing of remote generation results by passing a user-defined jq expression to the muapi tool. While this creates an ingestion point for external data, the risk is inherent to the tool's purpose and mitigated by standard shell quoting.
  • Ingestion points: Results fetched from the muapi.ai platform and the --jq filter argument in check-result.sh.
  • Boundary markers: Absent; the script relies on the muapi CLI tool's internal handling of arguments and data.
  • Capability inventory: The skill can execute the muapi command with various flags but does not perform direct network operations or file system writes itself.
  • Sanitization: Employs standard bash array and variable quoting ("${ARGS[@]}") to prevent local command injection during argument passing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:15 PM