elevenlabs-music-generation
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the "@runcomfy/cli" tool from NPM. This is a standard dependency for the skill's primary purpose and originates from a well-known service.
- [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection via user-supplied music style and lyric descriptions.
- Ingestion points: The prompt input parameter in SKILL.md captures untrusted user data.
- Boundary markers: The data is encapsulated within a JSON string for the CLI tool.
- Capability inventory: The skill uses the runcomfy CLI to execute music generation tasks.
- Sanitization: The skill documents that the CLI transmits JSON directly to the API, mitigating shell-level injection risks.
Audit Metadata