muapi-youtube-thumbnail

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill performs network operations by calling the MuAPI service via CLI or curl to api.muapi.ai. This is the intended core functionality of the skill and targets the service's official endpoint.
  • [COMMAND_EXECUTION]: Instructs the agent to execute muapi CLI commands and fallback curl commands. These commands are used to interact with the image generation API and are limited to the skill's stated purpose.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it interpolates user-provided text (title, channel_style, subject_description) into prompts for image generation.
  • Ingestion points: title, channel_style, and subject_description inputs in SKILL.md.
  • Boundary markers: Absent; inputs are directly substituted into the instruction templates.
  • Capability inventory: Execution of muapi CLI and curl network requests.
  • Sanitization: No explicit sanitization or escaping of user input is defined.
  • Assessment: This is a low-risk finding inherent to the nature of image generation skills, as the AI acts as an orchestrator for the API calls.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 02:04 PM
Security Audit — agent-trust-hub — muapi-youtube-thumbnail