creativeclaw-generate-audio
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input in the form of audio generation prompts and external media files or URLs.
- Ingestion points: User-provided text prompts for audio and music generation (SKILL.md, references/prompting.md) and external media file imports or public URLs (references/platform-upload.md).
- Boundary markers: The skill does not define specific delimiters or 'ignore instructions' warnings for the data passed to the generation tools.
- Capability inventory: The skill utilizes MCP tools such as generate_audio, merge_media, and upload_asset, which perform network operations and create persistent assets on the Creative Claw platform.
- Sanitization: No explicit sanitization, validation, or filtering logic is prescribed for the input prompts or media URLs before processing.
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to handle public HTTPS URLs for media importing.
- Evidence: In references/platform-upload.md, the instructions state that public, directly downloadable HTTPS URLs can be passed to generation tools or the upload_asset tool, allowing the agent to fetch content from arbitrary external domains.
Audit Metadata