muapi-multi-angle-shots

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-defined text for fields like product_name, background_style, and lighting, which are then directly interpolated into prompts for image generation models without sanitization or boundary markers. This creates a surface where a user could provide instructions intended to influence the behavior of the image generation models or the agent processing the results.
  • Ingestion points: product_name, background_style, lighting, and category inputs defined in SKILL.md.
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: The skill utilizes muapi image generate and curl for external API calls.
  • Sanitization: No input validation or escaping is performed before interpolation.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the muapi CLI tool and curl. These operations involve handling the MUAPI_API_KEY for authentication to the vendor's API at api.muapi.ai. While this is standard for tool integration, it involves execution of external commands and transmission of credentials over the network to the service provider.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:17 AM