music-analyze
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a system command using the user-supplied audio file path as an argument to a Python module.
- [INDIRECT_PROMPT_INJECTION]: The command template
python3 -m music_analyzer analyze "<audio_file_path>"is susceptible to shell command injection. If a user provides a file path containing shell metacharacters (e.g.,"; touch /tmp/injected; #), the underlying shell could execute those additional commands. While the instructions include a validation step, the safety depends on the strictness of the implementation.
Audit Metadata