byted-music-generate
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill manages sensitive credentials like API keys and secrets through environment variables, avoiding hardcoded secrets in the codebase.
- [SAFE]: Network operations are directed exclusively to official Volcengine API endpoints for the purpose of submitting and monitoring music generation tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for prompts and lyrics. 1. Ingestion points: User input for lyrics, prompt, and BGM description fields passed to scripts/music_generate.py via CLI arguments. 2. Boundary markers: None observed in the prompt construction. 3. Capability inventory: Network requests to open.volcengineapi.com via the requests library. 4. Sanitization: Inputs are serialized via json.dumps before transmission.
Audit Metadata