muapi-jewelry-product-video

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill takes user-defined inputs for jewelry and surface descriptions and interpolates them directly into prompts for image and video generation tools, creating a potential surface for indirect prompt injection.
  • Ingestion points: jewelry_description and surface_description parameters defined in the inputs section of SKILL.md.
  • Boundary markers: The skill does not use delimiters (like XML tags or triple quotes) or specific instructions to the agent to ignore potentially malicious content within these user inputs.
  • Capability inventory: The skill utilizes the muapi command-line interface and curl to send requests to an external API (api.muapi.ai).
  • Sanitization: No input validation, escaping, or filtering is performed on the user-provided text before it is used in the prompt construction.
  • [COMMAND_EXECUTION]: The skill requires the use of the muapi CLI tool for image and video generation and suggests using ffmpeg for video concatenation.
  • Evidence: Instructions include the use of muapi auth configure, muapi image generate, muapi video from-image, and a suggestion to use ffmpeg concat for final processing.
  • Fallback Behavior: The notes section provides a fallback mechanism using curl to interact directly with the Muapi API endpoint at https://api.muapi.ai/api/v1/ if CLI aliases are missing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:11 PM