eachlabs-music
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, which could be used to deliver malicious instructions to the agent.\n
- Ingestion points: The skill accepts external URLs in
mureka-upload-file,mureka-describe-song, andmureka-stem-song(SKILL.md). It also ingests user-provided text forpromptandlyricsfields.\n - Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potential commands embedded within external data.\n
- Capability inventory: The skill performs network operations via API calls to
api.eachlabs.aito process these inputs.\n - Sanitization: No sanitization, validation, or integrity checks for content retrieved from external URLs or provided in prompts are described.
Audit Metadata