claude-music-lora

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes Bash commands to run the acestep.training.train_lora module. It resolves the project path dynamically by reading a local configuration file (~/.claude/skills/claude-music/config.json) via a Python one-liner. This is a functional requirement for locating the required training binaries on the user's system.\n- [PROMPT_INJECTION]: The skill involves processing external audio files as training data. While this constitutes an external data ingestion surface, the risk of indirect prompt injection is negligible because the data consists of audio binaries processed by a non-LLM training pipeline rather than text interpreted as instructions by the agent.\n
  • Ingestion points: Audio files located in ~/Music/lora-datasets/ (referenced in SKILL.md).\n
  • Boundary markers: Not applicable for binary audio training data.\n
  • Capability inventory: The skill is authorized to use Bash, Read, and Write tools to perform training and manage files.\n
  • Sanitization: Standard audio validation is assumed to be handled by the acestep training module.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 07:36 PM
Security Audit — agent-trust-hub — claude-music-lora