muapi-multi-angle-shots
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-defined text for fields like
product_name,background_style, andlighting, which are then directly interpolated into prompts for image generation models without sanitization or boundary markers. This creates a surface where a user could provide instructions intended to influence the behavior of the image generation models or the agent processing the results. - Ingestion points:
product_name,background_style,lighting, andcategoryinputs defined inSKILL.md. - Boundary markers: None identified in the prompt templates.
- Capability inventory: The skill utilizes
muapi image generateandcurlfor external API calls. - Sanitization: No input validation or escaping is performed before interpolation.
- [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the
muapiCLI tool andcurl. These operations involve handling theMUAPI_API_KEYfor authentication to the vendor's API atapi.muapi.ai. While this is standard for tool integration, it involves execution of external commands and transmission of credentials over the network to the service provider.
Audit Metadata