muapi-media

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Utilizes system utilities such as curl, jq, mktemp, seq, and file to manage asynchronous API requests, handle JSON data, and validate media outputs.
  • [EXTERNAL_DOWNLOADS]: Fetches model schemas and downloads generated media assets from api.muapi.ai. The skill includes logic to ensure output URLs use HTTPS and follows a header-free download pattern to prevent credential leakage to CDNs.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes structured data from the MuAPI service which determines the execution flow of polling and downloading tasks.
  • Ingestion points: Processes models.json, model.json, and result.json files retrieved from the remote API using curl.
  • Boundary markers: Does not employ specific prompt delimiters for data interpolation but uses jq to extract values from structured JSON paths.
  • Capability inventory: Includes network communication (curl), file system manipulation ($workdir), and file content inspection (file).
  • Sanitization: Enforces HTTPS for all download URLs and utilizes the file utility to verify that downloaded content matches expected media formats.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 03:40 AM