skills/danicat/skills/lyria/Gen Agent Trust Hub

lyria

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The test suite (scripts/test_lyria.py) uses os.system and subprocess.run to verify the functionality of the CLI tool. These calls are restricted to checking for the presence of the uv tool and executing internal scripts with --help flags. These are standard development practices with no external input flowing into the commands.
  • [EXTERNAL_DOWNLOADS]: The skill uses official Google Generative AI libraries (google-genai) to interact with the Lyria models. All network communication is directed to well-known Google API endpoints for the intended purpose of music generation.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied text and images to generate music, the output is binary audio data (MP3/WAV). This significantly limits the attack surface for secondary instruction execution as the generated content cannot trigger subsequent shell commands or logic within the agent environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:34 AM