muapi-storyboard-to-cooking-video

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill takes multiple user inputs—dish, kitchen_style, and outfit—and interpolates them directly into the prompts for image and video generation tools.
  • Ingestion points: Inputs are defined in the Inputs section of SKILL.md and used in Step 1 and Step 2.
  • Boundary markers: The prompt templates do not use delimiters (like triple quotes or XML tags) or specific instructions to the underlying model to ignore instructions contained within those user fields.
  • Capability inventory: The skill uses the muapi CLI to interact with external AI services, requiring network access and environment variables for authentication.
  • Sanitization: There is no evidence of input validation or sanitization to prevent a user from providing malicious instructions that could influence the AI's output beyond the intended scope.
  • [COMMAND_EXECUTION]: The skill relies on executing the muapi CLI tool and potentially curl to interact with the vendor's API.
  • The instructions explicitly direct the executing agent to run shell commands to generate media.
  • Authentication involves managing the MUAPI_API_KEY via environment variables or CLI configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:11 PM