muapi-media
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Utilizes system utilities such as
curl,jq,mktemp,seq, andfileto manage asynchronous API requests, handle JSON data, and validate media outputs. - [EXTERNAL_DOWNLOADS]: Fetches model schemas and downloads generated media assets from
api.muapi.ai. The skill includes logic to ensure output URLs use HTTPS and follows a header-free download pattern to prevent credential leakage to CDNs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes structured data from the MuAPI service which determines the execution flow of polling and downloading tasks.
- Ingestion points: Processes
models.json,model.json, andresult.jsonfiles retrieved from the remote API usingcurl. - Boundary markers: Does not employ specific prompt delimiters for data interpolation but uses
jqto extract values from structured JSON paths. - Capability inventory: Includes network communication (
curl), file system manipulation ($workdir), and file content inspection (file). - Sanitization: Enforces HTTPS for all download URLs and utilizes the
fileutility to verify that downloaded content matches expected media formats.
Audit Metadata