muapi-instagram-post

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell-level commands using the muapi CLI tool, including muapi image generate, muapi image edit, and muapi auth configure.
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to perform POST requests to an external endpoint (https://api.muapi.ai/api/v1/<endpoint>) and interacts with muapi predict wait for long-polling, involving network operations to a specialized third-party service.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface where untrusted user input is interpolated into downstream actions.
  • Ingestion points: The brief and brand_style inputs are gathered from the user in SKILL.md.
  • Boundary markers: There are no explicit delimiters or instructions to the LLM to ignore potentially malicious content embedded within these inputs.
  • Capability inventory: The skill has the capability to perform network requests via curl and execute muapi CLI tools.
  • Sanitization: There is no evidence of sanitization, escaping, or validation of the brief or brand_style inputs before they are included in image generation prompts or API request bodies.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:17 AM