claude-music-cover
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to invoke local scripts such asmusic_engine.shandpreflight.shto perform audio processing tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where untrusted data (user-provided captions, lyrics, and file paths) is interpolated into shell commands. \n - Ingestion points: The
--caption,--lyrics, and--src-audioparameters in theBashcommand examples. \n - Boundary markers: None identified; inputs are passed directly as command-line arguments. \n
- Capability inventory: The skill uses the
Bashtool to execute subprocesses. \n - Sanitization: No explicit sanitization or escaping instructions are provided for the user-supplied strings.
Audit Metadata