muapi-floor-plan-rendering
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions that are directly interpolated into prompts, creating a surface for indirect prompt injection. * Ingestion points: The
floor_plan_descriptioninput inSKILL.md. * Boundary markers: Absent; user input is concatenated directly into the prompt string. * Capability inventory: Access to themuapiCLI andcurlfor network requests. * Sanitization: Absent; no input validation or escaping is performed. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with the architectural rendering service. * It uses the
muapiCLI tool for tasks likeimage generate,image edit, andauth configure. * It provides a fallbackcurlcommand for direct interaction with the API endpoint. - [DATA_EXFILTRATION]: The skill performs network operations to an external domain. * It transmits authentication tokens (
MUAPI_API_KEY) and user descriptions toapi.muapi.aito fulfill generation requests.
Audit Metadata