heartmula
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from
https://github.com/HeartMuLa/heartlib.gitand download model weights from Hugging Face repositories such asHeartMuLa/HeartMuLaGen. - [COMMAND_EXECUTION]: Installation and usage steps involve running shell commands to clone repositories and execute Python scripts from the downloaded source code, specifically
python ./examples/run_music_generation.py. - [DYNAMIC_EXECUTION]: The documentation requires manual patching of Python source files (
modeling_heartmula.pyandmusic_generation.py) within the downloaded library to fix compatibility issues with newer dependencies. - [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The generation script processes lyrics and genre tags from external text files. 2. Boundary markers: No delimiters or explicit instructions are provided to the model to ignore potential injection attempts in the input text. 3. Capability inventory: The skill is capable of writing generated audio files to the local filesystem. 4. Sanitization: No input validation or sanitization logic is documented in the instructions.
Audit Metadata