mc-workflow

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is primarily instructional and data-oriented. It establishes a complex YAML-based specification format for music projects and provides routing logic to other music-related skills. It does not contain executable scripts, network operations, or sensitive data access.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided musical 'briefs' to generate the ARR-SPEC metadata. While this represents a data ingestion point, the skill enforces a strict structured schema and a '20-point self-audit' process that effectively sanitizes user input and prevents the execution of embedded instructions. The final output is intended for music rendering backends, which typically do not process natural language instructions as code.
  • [COMMAND_EXECUTION]: The skill explicitly discourages the AI agent from writing or running custom scripts (e.g., Python linters) to validate the specifications, instead directing the agent to use the manual checklist provided. This follows security best practices by limiting the agent's autonomous code generation capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:41 PM