generative-media-skills
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install multiple skills from a third-party GitHub repository (
SamurAIGPT/Generative-Media-Skills) usingnpx skills add. - [EXTERNAL_DOWNLOADS]: Recommends the installation of an external command-line interface,
muapi-cli, from the npm registry. - [COMMAND_EXECUTION]: The skill provides bash scripts for the agent to execute, involving file existence checks and automated installation of external packages.
- [DATA_EXFILTRATION]: User-provided prompts and media are sent to the third-party domain
muapi.ai, which is outside the standard whitelisted domains for data transmission. - [INDIRECT_PROMPT_INJECTION]: The skill functions by transforming user-provided creative briefs into AI generation prompts, which could be exploited via malicious inputs if not properly sanitized.
- Ingestion points: Creative briefs and task descriptions processed at runtime (SKILL.md).
- Boundary markers: None identified in the skill instructions to delimit external content.
- Capability inventory: Shell command execution via
muapi-cli,npx, andcurlacross various recipes. - Sanitization: No evidence of input filtering or escaping for the ingested creative brief data.
Audit Metadata