musicfree-plugin-dev
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
playwrightpackage vianpm install -D playwrightto facilitate dynamic site analysis and network request observation. - [COMMAND_EXECUTION]: The workflow requires executing shell commands to check the environment (e.g.,
node --version) and to run generated analysis and testing scripts (e.g.,node probe.js,node test-plugin.js). - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests and analyzes untrusted content from external websites (HTML structures and JSON API responses) to determine selectors and data mapping logic. The instructions provide a systematic approach for the agent to process this data safely.
- [DYNAMIC_EXECUTION]: The agent is guided to generate JavaScript files (the plugins themselves and accompanying test suites) and execute them using Node.js to verify that API reproduction and data parsing work as expected.
- [DATA_EXPOSURE]: The skill defines a mechanism for users to provide sensitive credentials, such as Cookies, via
userVariablesto access authenticated features of music sites. This is a standard platform feature for the targeted music player and is handled explicitly through user input.
Audit Metadata