muapi-drone-style-video

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided text from the location_or_subject and style fields directly into the prompts used for video generation models.
  • Ingestion points: Inputs defined in SKILL.md such as location_or_subject and style.
  • Boundary markers: Absent; the instructions do not include delimiters or specific commands to ignore potential instructions embedded within the user's location or style descriptions.
  • Capability inventory: The skill possesses network access capabilities through the muapi CLI and curl commands to the api.muapi.ai endpoint.
  • Sanitization: No input validation, escaping, or filtering is applied to user inputs before they are interpolated into the final prompt strings.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution for its core operations, involving both a dedicated CLI and generic networking tools.
  • Evidence: The orchestrating instructions command the agent to run muapi video generate, muapi predict wait, and muapi auth configure.
  • Evidence: The skill provides a fallback mechanism using curl to interact with the https://api.muapi.ai/api/v1/ endpoint, passing the MUAPI_API_KEY environment variable in the headers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:17 AM