muapi-selfie-with-celebrities
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
muapiCLI andcurlto interact with the vendor's API atapi.muapi.ai. These commands are used to configure authentication and submit image/video generation requests to the service infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface where user-supplied text is interpolated into image generation prompts.
- Ingestion points: The
movie_nameinput field defined inSKILL.mdis directly embedded into the generation prompt. - Boundary markers: There are no delimiters or specific instructions to the model to ignore potential injection content within the
movie_namevariable. - Capability inventory: The skill uses
curlto perform network operations and executesmuapiCLI commands for content generation. - Sanitization: There is no evidence of sanitization or validation performed on the user input before it is used in the prompt construction.
Audit Metadata