muapi-instagram-post
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell-level commands using the
muapiCLI tool, includingmuapi image generate,muapi image edit, andmuapi auth configure. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto perform POST requests to an external endpoint (https://api.muapi.ai/api/v1/<endpoint>) and interacts withmuapi predict waitfor long-polling, involving network operations to a specialized third-party service. - [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where untrusted user input is interpolated into downstream actions.
- Ingestion points: The
briefandbrand_styleinputs are gathered from the user inSKILL.md. - Boundary markers: There are no explicit delimiters or instructions to the LLM to ignore potentially malicious content embedded within these inputs.
- Capability inventory: The skill has the capability to perform network requests via
curland executemuapiCLI tools. - Sanitization: There is no evidence of sanitization, escaping, or validation of the
brieforbrand_styleinputs before they are included in image generation prompts or API request bodies.
Audit Metadata