lyria
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The test suite (
scripts/test_lyria.py) usesos.systemandsubprocess.runto verify the functionality of the CLI tool. These calls are restricted to checking for the presence of theuvtool and executing internal scripts with--helpflags. These are standard development practices with no external input flowing into the commands. - [EXTERNAL_DOWNLOADS]: The skill uses official Google Generative AI libraries (
google-genai) to interact with the Lyria models. All network communication is directed to well-known Google API endpoints for the intended purpose of music generation. - [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied text and images to generate music, the output is binary audio data (MP3/WAV). This significantly limits the attack surface for secondary instruction execution as the generated content cannot trigger subsequent shell commands or logic within the agent environment.
Audit Metadata