muapi-design-guide
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the executing agent to perform shell operations, including configuring authentication via
muapi auth configureand usingcurlto interact with remote API endpoints if CLI aliases are missing. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data that is interpolated directly into prompts for third-party image generation models without sanitization or protective boundary markers.
- Ingestion points: The inputs
brand_name,industry,style_direction, andprimary_colorare accepted from the user inSKILL.md. - Boundary markers: No delimiters or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The skill possesses the ability to execute shell commands (
muapi,curl) and perform network operations to generate and retrieve image assets. - Sanitization: There is no evidence of input validation, escaping, or filtering for the user-provided text before it is inserted into model prompts.
- [EXTERNAL_DOWNLOADS]: The skill relies on an external CLI tool (
muapi) and makes network requests to theapi.muapi.aidomain to perform its core image generation functions.
Audit Metadata