muapi-media
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill correctly manages sensitive credentials by accessing the
MUAPI_API_KEYfrom the environment, avoiding hardcoded secrets or command-line exposure. - [SAFE]: The inclusion of a mandatory
--confirm-paidflag in the generation process provides a security control against unintended financial costs incurred by autonomous agent actions. - [SAFE]: The
download_outputfunction implements a protocol check, ensuring that only HTTPS URLs are accessed when downloading generated media artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill processes an external model catalog to resolve request endpoints, creating a surface for indirect prompt injection. \n
- Ingestion points: The model catalog is retrieved from the
MUAPI_BASE_URLinscripts/muapi_media.py. \n - Boundary markers: No explicit delimitation or instruction-ignoring markers are used for the catalog data. \n
- Capability inventory: The tool possesses network request capabilities (POST/GET) and file system write access. \n
- Sanitization: The script validates that endpoints begin with
/api/v1/and that download links use HTTPS.
Audit Metadata