muapi-action-figure-generator
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data which is interpolated into prompts for image generation.
- Ingestion points: The
toy_themetext input is used to construct the generation prompt inSKILL.md. - Boundary markers: Absent. User input is placed directly into the prompt string: 'The character is dressed in a {{toy_theme}} outfit'.
- Capability inventory: The skill executes CLI commands via
muapiand makes network requests usingcurltoapi.muapi.ai. - Sanitization: None. There is no evidence of input validation or escaping for the
toy_themevariable. - [COMMAND_EXECUTION]: The instructions direct the agent to interact with the system shell using specific CLI tools.
- Evidence: Use of
muapi image edit,muapi auth configure, andmuapi predict waitcommands. - Evidence: Use of
curlto interact with the raw API endpoint athttps://api.muapi.ai/api/v1/.
Audit Metadata