muapi-media-editing

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The shell scripts utilize system utilities such as curl for network requests, jq for parsing responses, and python3 for safe JSON encoding. It also leverages a muapi CLI tool which is expected for interacting with the service.
  • [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with api.muapi.ai to facilitate image and video processing tasks. These interactions are core to the skill's functionality and trace back to the service's official infrastructure.
  • [DATA_EXFILTRATION]: The skill allows users to upload local files to the MuAPI cloud for processing. This behavior is the intended and transparent method for the service to operate on user-provided assets.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and media URLs, which serves as a potential surface for indirect injection.
  • Ingestion points: Input is accepted via command-line arguments across the edit-image.sh, enhance-image.sh, lipsync.sh, and video-effects.sh scripts.
  • Boundary markers: Prompts are structured within JSON payloads during API transmission, providing a clear delimiter between the command structure and user data.
  • Capability inventory: The skill possesses file-reading capabilities for uploads and network access to the vendor's API.
  • Sanitization: All scripts use a Python-based JSON encoder to ensure that user prompts are correctly escaped before being sent to the remote API, effectively mitigating basic structural injection attempts at the communication layer.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:18 AM