Skills
Navigate
skills/comeonoliver/skillshub/ai-music-generation/Gen Agent Trust Hub

ai-music-generation

Fail

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation command curl -fsSL https://cli.inference.sh | sh downloads a script from a remote URL and executes it immediately in the shell, bypassing manual code review.
  • [COMMAND_EXECUTION]: The skill requires the use of the infsh CLI tool, which is an external binary capable of executing commands and communicating with remote APIs.
  • [EXTERNAL_DOWNLOADS]: The skill documentation points to dist.inference.sh for binary downloads and cli.inference.sh for the installation script.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it places untrusted user prompts directly into command-line arguments. * Ingestion points: prompt and lyrics fields in the infsh app run commands within SKILL.md. * Boundary markers: No explicit boundaries or instructions are provided to the agent to treat input as untrusted data. * Capability inventory: Use of the Bash tool to run the infsh binary. * Sanitization: No input validation or escaping is implemented for user-provided strings.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 25, 2026, 06:52 PM
Security Audit — agent-trust-hub — ai-music-generation