The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill accepts a user-controlled text input (toy_theme) which is directly interpolated into the prompt used for image generation.
Ingestion points: toy_theme input variable in SKILL.md.
Boundary markers: Absent. The input is placed directly into the prompt string: "The character is dressed in a {{toy_theme}} outfit."
Capability inventory: Calls to muapi image edit and curl to external endpoints.
Sanitization: Absent. No instructions are provided to the agent to sanitize or validate the user input for malicious injection patterns.
[COMMAND_EXECUTION]: The skill requires the execution of CLI tools and shell commands to perform its primary functions.
Evidence: SKILL.md references muapi image edit, muapi auth configure, and muapi predict wait commands.
[DATA_EXFILTRATION]: The skill performs network operations to an external, non-whitelisted domain to interact with a third-party API.
Evidence: The skill directs the agent to use curl to interact with "https://api.muapi.ai/api/v1/" and mentions using the MUAPI_API_KEY environment variable for authentication.

muapi-action-figure-generator