music-color-palette
Warn
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include a step to execute a Python module via a shell command:
python3 -m music_analyzer color-palette "<input_path>". The<input_path>parameter is derived directly from user input. While wrapped in double quotes, this pattern is susceptible to command injection attacks if the input contains shell-sensitive characters like backticks, dollar signs, or semicolons that the shell might interpret. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of audio files or analysis JSON, which provides a surface for indirect prompt injection.
- Ingestion points:
<audio_file_or_analysis_json>parameter (SKILL.md). - Boundary markers: Absent. The input is passed directly to the execution command without delimiters or safety warnings.
- Capability inventory: Shell command execution via
python3(SKILL.md). - Sanitization: Absent. The skill does not specify any validation or sanitization of the input path or the content of the JSON file before processing.
Audit Metadata