muapi-logo-branding
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill takes multiple user-supplied inputs (
brand_name,industry,style_preference,color_preference,mood) and interpolates them directly into image generation prompts without sanitization or boundary markers. This creates a surface for indirect prompt injection where a malicious user could provide instructions to manipulate the image generation process. - Ingestion points: Input variables in
SKILL.md. - Boundary markers: Absent.
- Capability inventory: External API calls via
muapiCLI andcurlinSKILL.md. - Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill instructions direct the executing agent to run the
muapiCLI tool (muapi image generate,muapi auth configure) and fallbackcurlcommands. While these are intended for the skill's functionality, they represent the execution of shell commands based on skill instructions. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to
api.muapi.aito generate images and poll for results. These requests include API authentication headers using theMUAPI_API_KEYenvironment variable.
Audit Metadata