muapi-seedance-2
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The
scripts/generate-seedance.shscript includes anupload_filefunction that sends local image files tohttps://api.muapi.ai/api/v1/upload_filefor processing. This behavior is required for the Image-to-Video functionality of the skill. - [EXTERNAL_DOWNLOADS]: The skill downloads generated video files from URLs provided by the MuAPI backend and saves them locally in a media output directory.
- [COMMAND_EXECUTION]: The script executes a core video generation script at a relative path and uses the macOS
openutility to display files when the--viewflag is used. - [PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by interpolating user-provided scene descriptions into cinematic templates. Ingestion points: The
--subjectand--filearguments inscripts/generate-seedance.sh. Boundary markers: None present. Capability inventory: Subprocess execution, network requests viacurl, and file system access. Sanitization: Prompt strings are JSON-encoded using Python for API payloads.
Audit Metadata