claude-music-export
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute FFmpeg commands for audio normalization and conversion. It also references the execution of a local shell script at ~/.claude/skills/claude-music/scripts/music_export.sh during batch processing.- [PROMPT_INJECTION]: The skill instructions create a surface for indirect prompt injection by processing external data without validation.
- Ingestion points: The skill processes input audio files and multiple metadata fields (title, artist, album, date, genre, comment) provided as command arguments.
- Boundary markers: No delimiters or ignore-instructions are used to isolate untrusted data.
- Capability inventory: The skill uses the Bash tool, allowing for file system access and command execution.
- Sanitization: Metadata strings and filenames are not escaped or sanitized before being interpolated into shell commands.
Audit Metadata