claude-music-lora
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Bash commands to run the
acestep.training.train_loramodule. It resolves the project path dynamically by reading a local configuration file (~/.claude/skills/claude-music/config.json) via a Python one-liner. This is a functional requirement for locating the required training binaries on the user's system.\n- [PROMPT_INJECTION]: The skill involves processing external audio files as training data. While this constitutes an external data ingestion surface, the risk of indirect prompt injection is negligible because the data consists of audio binaries processed by a non-LLM training pipeline rather than text interpreted as instructions by the agent.\n - Ingestion points: Audio files located in
~/Music/lora-datasets/(referenced in SKILL.md).\n - Boundary markers: Not applicable for binary audio training data.\n
- Capability inventory: The skill is authorized to use
Bash,Read, andWritetools to perform training and manage files.\n - Sanitization: Standard audio validation is assumed to be handled by the
acesteptraining module.
Audit Metadata