muapi-storyboard
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the 'muapi' CLI tool and 'curl' to interact with the generation service.
- [EXTERNAL_DOWNLOADS]: The skill relies on an external command-line dependency 'muapi' which is not a standard system utility.
- [INDIRECT_PROMPT_INJECTION]: The skill interpolates user-controlled input from the 'premise' and 'style' fields directly into prompts for image generation. Ingestion points: 'premise' and 'style' inputs in SKILL.md. Boundary markers: None present to delimit user input from instructions. Capability inventory: Command execution via CLI and curl. Sanitization: No sanitization or validation of user input is specified.
- [DATA_EXFILTRATION]: The skill performs network operations via 'curl' to 'api.muapi.ai', transmitting a sensitive credential ($MUAPI_API_KEY) in the request headers.
Audit Metadata