music-analyze
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
music_analyzerPython module via a shell command to process local audio files. This involves direct execution of a command-line tool based on user instructions. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface where user-provided audio file paths are interpolated into a bash command string:
python3 -m music_analyzer analyze "<audio_file_path>". - Ingestion points: Untrusted file paths enter the context via the usage instructions in
SKILL.md. - Boundary markers: The input is wrapped in double quotes, which can be escaped if the input contains unescaped quote characters.
- Capability inventory: The skill performs shell command execution using
python3(SKILL.md). - Sanitization: There are no explicit sanitization, validation, or escaping instructions provided within the skill to handle potentially malicious file paths.
Audit Metadata