Skills
skills/samuraigpt/generative-media-skills/muapi-media-generation/Gen Agent Trust Hub

muapi-media-generation

Warn

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The scripts create-music.sh and image-to-video.sh contain an --add-key option that writes the user's MUAPI_KEY into a plaintext .env file. This leads to insecure storage of sensitive credentials in the local environment.\n- [REMOTE_CODE_EXECUTION]: In generate-image.sh and generate-video.sh, the --view flag downloads a file from a URL provided by the remote API and executes the open command on it. This creates a risk where a compromised or malicious API response could cause the execution of harmful files on macOS.\n- [COMMAND_EXECUTION]: The scripts use curl to upload local files to the vendor's server via the upload_file function. The file paths are taken directly from user-provided arguments.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface.\n
  • Ingestion points: The --prompt and --image-url arguments in all generation scripts (e.g., generate-image.sh).\n
  • Boundary markers: None are used to delimit user input in the API payload.\n
  • Capability inventory: Network access via curl and file execution via open.\n
  • Sanitization: Prompt content is escaped using python3's json.dumps before transmission.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 13, 2026, 09:18 AM