acestep
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing a local Python tool
tools/music_gen.pyto perform music generation and audio processing tasks. The instructions demonstrate standard command-line usage including argument passing and output file management. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data as it accepts user-defined prompts and lyrics which are then passed to an AI model for generation.
- Ingestion points: Untrusted data enters the system through the
--promptand--lyricscommand-line arguments, as well as through reference audio files for style transfer. - Boundary markers: The instructions do not define specific delimiters or boundary markers for these inputs within the CLI commands.
- Capability inventory: The skill possesses the capability to execute the
tools/music_gen.pyscript and write output files to the local file system. - Sanitization: There are no explicit sanitization or validation steps described for the prompt or lyrics strings before they are passed to the tool.
Audit Metadata