muapi-couple-grid-creator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests an external image URL (
couple_image) which is processed by theqwen-image-edit-plusmodel. This represents a potential surface for indirect prompt injection if the image contains embedded instructions, though the risk is limited to the image generation task. - Ingestion points:
SKILL.md(Phase A, Step 1 uses{{couple_image}}). - Boundary markers: Not applicable for image processing instructions.
- Capability inventory:
muapi image edit(CLI tool),curl(fallback network operation). - Sanitization: Relies on the underlying model's internal safety filters for image content.
- [EXTERNAL_DOWNLOADS]: The skill instructions include a fallback mechanism using
curlto interact withapi.muapi.ai. This is the official API endpoint for the service required by the skill and is considered a well-known service in this context. - Evidence:
curl -X POST https://api.muapi.ai/api/v1/<endpoint> -H "x-api-key: $MUAPI_API_KEY"inSKILL.md.
Audit Metadata