muapi-jewelry-product-video
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill takes user-defined inputs for jewelry and surface descriptions and interpolates them directly into prompts for image and video generation tools, creating a potential surface for indirect prompt injection.
- Ingestion points:
jewelry_descriptionandsurface_descriptionparameters defined in the inputs section ofSKILL.md. - Boundary markers: The skill does not use delimiters (like XML tags or triple quotes) or specific instructions to the agent to ignore potentially malicious content within these user inputs.
- Capability inventory: The skill utilizes the
muapicommand-line interface andcurlto send requests to an external API (api.muapi.ai). - Sanitization: No input validation, escaping, or filtering is performed on the user-provided text before it is used in the prompt construction.
- [COMMAND_EXECUTION]: The skill requires the use of the
muapiCLI tool for image and video generation and suggests usingffmpegfor video concatenation. - Evidence: Instructions include the use of
muapi auth configure,muapi image generate,muapi video from-image, and a suggestion to useffmpeg concatfor final processing. - Fallback Behavior: The notes section provides a fallback mechanism using
curlto interact directly with the Muapi API endpoint athttps://api.muapi.ai/api/v1/if CLI aliases are missing.
Audit Metadata