muapi-storyboard-to-cooking-video
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill takes multiple user inputs—
dish,kitchen_style, andoutfit—and interpolates them directly into the prompts for image and video generation tools. - Ingestion points: Inputs are defined in the
Inputssection ofSKILL.mdand used in Step 1 and Step 2. - Boundary markers: The prompt templates do not use delimiters (like triple quotes or XML tags) or specific instructions to the underlying model to ignore instructions contained within those user fields.
- Capability inventory: The skill uses the
muapiCLI to interact with external AI services, requiring network access and environment variables for authentication. - Sanitization: There is no evidence of input validation or sanitization to prevent a user from providing malicious instructions that could influence the AI's output beyond the intended scope.
- [COMMAND_EXECUTION]: The skill relies on executing the
muapiCLI tool and potentiallycurlto interact with the vendor's API. - The instructions explicitly direct the executing agent to run shell commands to generate media.
- Authentication involves managing the
MUAPI_API_KEYvia environment variables or CLI configuration.
Audit Metadata