mira-generate
Warn
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill incorporates tools such as
blender_execute_pythonandadobe_execute_scriptdesigned to run dynamically generated Python and ExtendScript code within a user's local instance of Blender, After Effects, or Premiere Pro. While intended for automating creative tasks, this functionality allows for arbitrary code execution within the context of those applications and their associated data. - [INDIRECT_PROMPT_INJECTION]: The skill features a "Community Guides" system (via
get_mira_guideandsearch_mira_guides) that ingests content created by other users on the Mira platform. These guides contain prompts and recipes that the agent is instructed to "repeat" or adapt, creating a surface where malicious third-party content could influence the agent's behavior. - Ingestion points: External data from
mira.mybots.pro/guidesis retrieved and processed through theget_mira_guidetool. - Boundary markers: The skill documentation lacks specific instructions for using delimiters or boundary markers to isolate untrusted community content from the primary agent instructions.
- Capability inventory: The skill possesses powerful capabilities including local script execution (Blender/Adobe), social media publishing (Instagram/Threads), and the ability to spend financial credits for generations.
- Sanitization: There is no mention of automated sanitization, filtering, or validation of the untrusted guide content before it is integrated into the agent's context.
- [COMMAND_EXECUTION]: In addition to raw script execution, the tool
adobe_commandprovides a command-based interface for interacting with local video editing software, which, while more structured, still provides deep access to the user's local project environment.
Audit Metadata