muapi-design-guide

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the executing agent to perform shell operations, including configuring authentication via muapi auth configure and using curl to interact with remote API endpoints if CLI aliases are missing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data that is interpolated directly into prompts for third-party image generation models without sanitization or protective boundary markers.
  • Ingestion points: The inputs brand_name, industry, style_direction, and primary_color are accepted from the user in SKILL.md.
  • Boundary markers: No delimiters or instructions to ignore embedded commands are present in the prompt templates.
  • Capability inventory: The skill possesses the ability to execute shell commands (muapi, curl) and perform network operations to generate and retrieve image assets.
  • Sanitization: There is no evidence of input validation, escaping, or filtering for the user-provided text before it is inserted into model prompts.
  • [EXTERNAL_DOWNLOADS]: The skill relies on an external CLI tool (muapi) and makes network requests to the api.muapi.ai domain to perform its core image generation functions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:11 PM