muapi-product-ad-cinematic

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user text (brand_brief) and interpolates it directly into prompts for image and audio generation tools without explicit sanitization or boundary markers.
  • Ingestion points: The brand_brief input field in SKILL.md.
  • Boundary markers: None present; the brief is used directly in natural language prompts (e.g., "ambient cinematic, warm strings, slow tempo, instrumental" based on the brief).
  • Capability inventory: The skill uses muapi CLI commands and curl for network requests to generate images, video, and audio.
  • Sanitization: No explicit sanitization or escaping of the user-provided brief is mentioned before it is passed to the generation models.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the muapi CLI and curl for interacting with the MuAPI platform. These operations are within the expected functional scope of the skill for generating and processing media assets via the vendor's infrastructure (api.muapi.ai).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:11 PM