chordpro
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests to external domains including lrclib.net, chord4.com, ultimate-guitar.com, and media platforms like YouTube, Bilibili, and SoundCloud to fetch lyrics, chord charts, and audio. These operations are essential to the skill's primary purpose and target well-known services.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites (HTML charts and JSON lyrics) which is then processed to create ChordPro files. This presents a potential attack surface where malicious directives could be embedded in the fetched content. The skill mitigates this by providing local validation scripts (
validate-cho.sh) to verify the integrity of the generated files. - [REMOTE_CODE_EXECUTION]: Documentation provides instructions for installing the official ChordPro tool using
cpanmand a well-known Perl bootstrap script (cpanmin.us). These are standard procedures for the required external dependencies.
Audit Metadata