muapi-logo-branding

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill takes multiple user-supplied inputs (brand_name, industry, style_preference, color_preference, mood) and interpolates them directly into image generation prompts without sanitization or boundary markers. This creates a surface for indirect prompt injection where a malicious user could provide instructions to manipulate the image generation process.
  • Ingestion points: Input variables in SKILL.md.
  • Boundary markers: Absent.
  • Capability inventory: External API calls via muapi CLI and curl in SKILL.md.
  • Sanitization: Absent.
  • [COMMAND_EXECUTION]: The skill instructions direct the executing agent to run the muapi CLI tool (muapi image generate, muapi auth configure) and fallback curl commands. While these are intended for the skill's functionality, they represent the execution of shell commands based on skill instructions.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to api.muapi.ai to generate images and poll for results. These requests include API authentication headers using the MUAPI_API_KEY environment variable.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:17 AM