The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts upload.sh, create-music.sh, and image-to-video.sh allow the user to specify local file paths via flags like --file or --image-file. These files are then uploaded to the vendor's API at https://api.muapi.ai/api/v1/upload_file using curl -F. This functionality can be abused to exfiltrate sensitive files (e.g., SSH keys, credentials, or system configurations) if an agent is instructed to process such paths by a malicious prompt.
[COMMAND_EXECUTION]: In generate-image.sh and generate-video.sh, the --view flag triggers a download of the generated media followed by the open command on macOS systems. If the resulting URL from the API is hijacked or points to a malicious file, the skill would automatically execute/open it on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from multiple sources without sufficient isolation.
Ingestion points: User-provided prompts, media URLs, and local files provided via script arguments in SKILL.md and referenced bash scripts.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the prompt assembly logic.
Capability inventory: The skill has the ability to read local files, perform network POST requests to external APIs, and execute system commands (open) on the host.
Sanitization: While prompts are JSON-encoded via a Python helper to prevent JSON breakage, the content itself is not sanitized for instructions, and file paths are used directly in shell commands.
[DYNAMIC_EXECUTION]: The scripts dynamically construct API payloads and resolve endpoints by reading from a local configuration file (schema_data.json). It also utilizes python3 -c at runtime to perform JSON encoding of input strings.

muapi-media-generation