The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to perform network operations against api.muapi.ai, which is not a whitelisted domain. The instructions specifically guide the agent to include the MUAPI_API_KEY in the request headers, which is a sensitive credential.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the handling of untrusted inputs.
Ingestion points: User-provided brand_brief and product_image fields defined in SKILL.md.
Boundary markers: None. The skill uses direct interpolation of user inputs into tool prompts without delimiters or instructions to ignore potential embedded commands.
Capability inventory: The skill utilizes the muapi CLI for image, video, and audio generation, along with curl for direct API interaction.
Sanitization: No evidence of input sanitization or validation is present before interpolation into tool commands.
[COMMAND_EXECUTION]: The skill relies on the dynamic construction and execution of shell commands, specifically the muapi CLI and curl binary. These commands are built using a combination of environment variables and user-supplied parameters, which could lead to unexpected behavior if inputs are not properly sanitized by the underlying tools.

muapi-product-ad-cinematic