muapi-ugc-video-factory

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from fields such as script, environment, person, and product and interpolates them directly into prompts for downstream AI models (GPT and Seedance).
  • Ingestion points: Inputs defined in SKILL.md (person, product, script, environment).
  • Boundary markers: None explicitly used to delimit user-provided content within the generated prompts.
  • Capability inventory: The skill utilizes the muapi CLI and curl to interact with the vendor's API, which includes file upload and video generation capabilities.
  • Sanitization: No sanitization or validation of the input strings is performed before interpolation.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the muapi CLI and curl.
  • Evidence: Mentions muapi image edit, muapi video from-image, muapi upload file <path>, and curl -X POST https://api.muapi.ai/api/v1/.
  • Context: These operations are part of the core functionality intended by the skill's author to interface with their platform.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:17 AM