claude-music-export

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute FFmpeg commands for audio normalization and conversion. It also references the execution of a local shell script at ~/.claude/skills/claude-music/scripts/music_export.sh during batch processing.- [PROMPT_INJECTION]: The skill instructions create a surface for indirect prompt injection by processing external data without validation.
  • Ingestion points: The skill processes input audio files and multiple metadata fields (title, artist, album, date, genre, comment) provided as command arguments.
  • Boundary markers: No delimiters or ignore-instructions are used to isolate untrusted data.
  • Capability inventory: The skill uses the Bash tool, allowing for file system access and command execution.
  • Sanitization: Metadata strings and filenames are not escaped or sanitized before being interpolated into shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 07:37 PM
Security Audit — agent-trust-hub — claude-music-export