muapi-selfie-with-celebrities

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the muapi CLI and curl to interact with the vendor's API at api.muapi.ai. These commands are used to configure authentication and submit image/video generation requests to the service infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface where user-supplied text is interpolated into image generation prompts.
  • Ingestion points: The movie_name input field defined in SKILL.md is directly embedded into the generation prompt.
  • Boundary markers: There are no delimiters or specific instructions to the model to ignore potential injection content within the movie_name variable.
  • Capability inventory: The skill uses curl to perform network operations and executes muapi CLI commands for content generation.
  • Sanitization: There is no evidence of sanitization or validation performed on the user input before it is used in the prompt construction.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 11:15 PM