muapi-photo-pack-generator

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate-pack.sh invokes shell scripts located at ../../../../core/media/upload.sh and ../../../../core/media/generate-image.sh to handle media processing and image generation within the host environment.
  • [EXTERNAL_DOWNLOADS]: When the --view flag is enabled, scripts/generate-pack.sh uses curl to download generated images from the service's content delivery network to a local media_outputs directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection by interpolating user-controlled data into instructions for the image generation model.
  • Ingestion points: The --likeness command-line argument and the content of reference images (provided via --image or --image-url) in scripts/generate-pack.sh.
  • Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when constructing the final prompt.
  • Capability inventory: The skill possesses the ability to execute shell scripts and perform network operations via curl.
  • Sanitization: The user-supplied likeness string is used directly in the SUBJECT variable without escaping or validation before being included in the model prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:18 AM