acestep
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the ACE-Step API (either local or at api.acemusic.ai) to process music generation requests and retrieve audio results.\n- [COMMAND_EXECUTION]: The provided scripts/acestep.sh utility executes common shell commands including curl, jq, and basic filesystem operations to manage the API lifecycle.\n- [DYNAMIC_EXECUTION]: The bash script invokes python3 with static command-line templates to perform necessary Base64 encoding and decoding of audio data.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for user-provided lyrics and captions. While this creates an input surface, the script correctly escapes these inputs using jq and encapsulates them within structured API payloads to prevent unintended instruction execution.
Audit Metadata