skills/guyronnen/openmontage/music/Gen Agent Trust Hub

music

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the official ElevenLabs infrastructure for its primary functionality.
  • Fetches music generation and upload services from the official ElevenLabs API domain (api.elevenlabs.io).
  • Recommends the installation of official client libraries from the NPM registry (@elevenlabs/elevenlabs-js) and PyPI (elevenlabs).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language prompts and structured composition plans which could potentially include instructions from untrusted sources if the agent is processing external data.
  • Ingestion points: The prompt and composition_plan parameters in SKILL.md and references/api_reference.md are the primary entry points for external data.
  • Boundary markers: The skill instructions do not specify explicit delimiters for user input, relying instead on ElevenLabs' internal content filtering mentioned in the 'Content Restrictions' section.
  • Capability inventory: The skill utilizes standard file system operations (fs.createWriteStream in JavaScript, open() in Python) to save generated audio files and makes network requests via curl and official SDKs.
  • Sanitization: No explicit sanitization or validation of the prompt content is performed within the skill instructions beyond the service provider's own safety checks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:09 AM
Security Audit — agent-trust-hub — music