promo-music-maker
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions to execute a local script,
scripts/mureka.py, which serves as a bridge to the Mureka music generation API. This is used to synthesize background music based on generated prompts. - [EXTERNAL_DOWNLOADS]: The skill facilitates communication with the Mureka API (
api.mureka.cn). It follows security best practices by requiring API keys to be provided via environment variables (MUREKA_API_KEY) rather than being hardcoded within the skill itself. - [SAFE]: The skill performs data ingestion from external files such as
04-edl.mdand02-storyboard.mdto contextualize music generation. While this constitutes an indirect prompt injection surface, the operation is consistent with the skill's primary purpose and the risk is moderated by the use of structured output templates. - Ingestion points: Local project files including
04-edl.md,02-storyboard.md,DESIGN.md,05-delivery.md, and01-brief.md. - Boundary markers: Absent.
- Capability inventory: Subprocess execution (
python scripts/mureka.py) and local file writing (06-music-plan.md). - Sanitization: The skill uses strict formatting and English-only prompt requirements to structure the data processed from input files.
Audit Metadata