muapi-amazon-product-listing
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts several user-controlled inputs (
product_name,key_features,target_buyer) which are directly interpolated into natural language prompts for image generation models (gpt4o-text-to-image,nano-banana-pro, etc.). - Ingestion points: Inputs defined in
SKILL.mdsuch askey_featuresandproduct_nameare used to construct model prompts. - Boundary markers: The skill does not use delimiters or instructions to the model to ignore potentially malicious content within the user-provided data.
- Capability inventory: The skill uses
muapiCLI commands andcurlto interact with the Muapi API for image generation and task polling. - Sanitization: There is no evidence of input validation or sanitization to prevent adversarial instructions from being injected into the generated prompts.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using the
muapiCLI andcurlto interact with external API endpoints (api.muapi.ai). These operations are used to transmit user-provided data and API credentials (MUAPI_API_KEY) to the vendor's service.
Audit Metadata