create-music-elevenlabs
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/gen_music.pyinvokesffmpegviasubprocess.runto normalize audio levels and apply fades to the generated music. The command arguments are passed as a list to avoid shell parsing risks. - [CREDENTIALS_UNSAFE]: The skill accesses
~/.gooseworks/credentials.jsonto retrieve the API key and base URL required for proxy authentication. This behavior is consistent with the vendor's (gooseworks-ai) infrastructure for usage tracking. - [EXTERNAL_DOWNLOADS]: Requests are sent to a GooseWorks internal proxy at a URL defined in the user's credentials file. This allows the skill to interface with ElevenLabs Music services while billing usage to the agent.
- [PROMPT_INJECTION]: The skill processes user-supplied music prompts via the
--promptargument inscripts/gen_music.py. The data is passed to the generation API as untrusted input without specific delimiters or sanitization.
Audit Metadata