muapi-action-figure-generator

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data which is interpolated into prompts for image generation.
  • Ingestion points: The toy_theme text input is used to construct the generation prompt in SKILL.md.
  • Boundary markers: Absent. User input is placed directly into the prompt string: 'The character is dressed in a {{toy_theme}} outfit'.
  • Capability inventory: The skill executes CLI commands via muapi and makes network requests using curl to api.muapi.ai.
  • Sanitization: None. There is no evidence of input validation or escaping for the toy_theme variable.
  • [COMMAND_EXECUTION]: The instructions direct the agent to interact with the system shell using specific CLI tools.
  • Evidence: Use of muapi image edit, muapi auth configure, and muapi predict wait commands.
  • Evidence: Use of curl to interact with the raw API endpoint at https://api.muapi.ai/api/v1/.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:11 PM