The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to invoke the muapi command-line interface and use curl to interact with remote API endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data which is then interpolated into shell commands and API payloads.
Ingestion points: User-provided text for product_name, model_description, and setting is collected and used in the generation steps.
Boundary markers: No delimiters or safety instructions are provided to separate user data from the command strings.
Capability inventory: The skill possesses the ability to execute shell commands (muapi CLI) and network utilities (curl).
Sanitization: The instructions lack requirements for sanitizing or escaping user inputs before they are substituted into muapi or curl commands, creating a potential command injection vector.
[DATA_EXFILTRATION]: The skill performs network operations to api.muapi.ai. While these operations are functional for the skill's purpose, the domain is not on the standard whitelist, and the requests involve transmitting an API key and user-controlled data to an external service.

muapi-ugc-lifestyle-try-on