Skills
Navigate
skills/grahama1970/agent-skills/create-music/Gen Agent Trust Hub

create-music

Fail

Audited by Gen Agent Trust Hub on Mar 17, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/rvc_setup.sh script clones the RVC-Project/Retrieval-based-Voice-Conversion-WebUI repository from GitHub. It also downloads model weights from HuggingFace, which is recognized as a well-known service.
  • [REMOTE_CODE_EXECUTION]: The setup script scripts/rvc_setup.sh automatically executes pip install on the requirements file provided by the unverified third-party repository, which allows for the installation of unvetted dependencies and the execution of installation scripts.
  • [COMMAND_EXECUTION]: The skill's primary execution paths in scripts/rvc_infer.sh and scripts/rvc_train.sh involve running Python modules directly from the cloned external repository's directory.
  • [EXTERNAL_DOWNLOADS]: The run.sh script uses an external Docker image mrloldev/musicgen:latest as the base for music generation, introducing a dependency on a container image from an unverified maintainer.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 17, 2026, 06:35 AM
Security Audit — agent-trust-hub — create-music