muapi-logo-creator
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The create-logo.sh script invokes a local image generation utility (generate-image.sh) found in the project core directory structure. This is standard behavior for skills relying on core platform utilities.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied brand names and design concepts which are interpolated into an LLM prompt. While this is an injection surface, it is intrinsic to the skill's design and is considered safe given the limited scope of the output (image generation). 1. Ingestion points: Brand and concept arguments in scripts/create-logo.sh. 2. Boundary markers: Uses [LOGO_BRIEF] markers but lacks explicit delimiters for user content. 3. Capability inventory: Limited to internal image generation. 4. Sanitization: Input strings are not sanitized before interpolation.
Audit Metadata