muapi-youtube-shorts
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of a local bash script (
library/social/youtube-shorts/scripts/run-youtube-shorts.sh) and system utilities likejqandxargsto process video data. - [EXTERNAL_DOWNLOADS]: The skill interacts with the
muapi.aimanaged endpoint (/ai-clipping) for processing and references a GitHub repository (SamurAIGPT/AI-Youtube-Shorts-Generator) as a reference implementation. It also involves uploading local files to the muapi CDN. - [INDIRECT_PROMPT_INJECTION]: The skill presents a command injection surface by interpolating user-provided data (e.g.,
--source "<YOUTUBE_URL>") directly into shell commands. - Ingestion points: The
--sourceinput parameter inSKILL.mdaccepts arbitrary URLs or local file paths. - Boundary markers: None are defined to separate user input from the shell command structure.
- Capability inventory: The skill uses
bashto execute scripts and uses themuapi-clitool to interact with remote services, including file uploads. - Sanitization: There are no instructions for the agent to sanitize or validate the format of the source URL or file path before execution.
Audit Metadata