muapi-one-shot-video

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because user-provided inputs are used to construct prompts for the video generation models.\n
  • Ingestion points: The scene and style input fields in SKILL.md.\n
  • Boundary markers: No delimiters or protective instructions are used to separate user data from the core prompt instructions.\n
  • Capability inventory: The skill executes CLI tools and makes network requests via curl.\n
  • Sanitization: No input filtering or escaping is implemented to mitigate malicious instructions within the scene or style text.\n- [COMMAND_EXECUTION]: The skill directs the agent to execute muapi CLI commands and shell commands like curl for service interactions.\n- [DATA_EXFILTRATION]: The skill performs network requests to api.muapi.ai to transmit generation parameters and retrieve results, which involves the use of the MUAPI_API_KEY for authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:18 AM