muapi-ui-design
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script
scripts/generate-mockup.shto perform its primary function. This script is used to expand a user-provided brief into design specifications. - Evidence: The 'Invoke the Script' section provides a command example:
bash scripts/generate-mockup.sh --desc "..." --platform mobile --theme dark --style glassmorphism. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions to generate design briefs for downstream image generation, creating a surface for indirect prompt injection.
- Ingestion points: User input is ingested via the
--descargument in theSKILL.mdexecution example. - Boundary markers: Absent; the instructions do not specify any delimiters or safety markers for the user-provided text.
- Capability inventory: The skill utilizes shell script execution (
bash) and image generation (core/media/generate-image.sh). - Sanitization: Absent; there are no instructions provided for sanitizing or escaping the content of the product brief before it is processed by the scripts.
Audit Metadata