muapi-blog-header
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, including a specific CLI tool (
muapi) andcurl, to perform image generation and status polling. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to an external API endpoint at
api.muapi.aito submit generation requests and retrieve assets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input which is then interpolated into prompts and API calls, creating a surface for indirect instructions to influence the agent or the image generation model.
- Ingestion points: User-provided inputs
topic,publication_style, anddominant_colorare used directly in visual metaphor construction and prompt building. - Boundary markers: None; there are no delimiters or instructions to the agent to treat user input as untrusted data.
- Capability inventory: The skill uses the
muapiCLI andcurlfor network requests and asset creation. - Sanitization: The instructions do not include any validation, escaping, or filtering of the user-provided text before interpolation.
Audit Metadata