audio-music-generate
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a user-controlled
promptvariable within a shell command:meitu audio-music-generate --prompt "<style/scene/mood>". This creates a vulnerability surface for command injection if the agent fails to escape shell-special characters in the user's input. Evidence chain: Ingestion point is thepromptargument in SKILL.md; Capability is themeitubinary execution; Boundary markers are absent in the command template; Sanitization instructions are missing. - [SAFE]: The access to sensitive files such as
~/.meitu/credentials.jsonand~/.meitu/tool-registry.jsonis appropriate for this skill as it is authored by Meitu and requires these credentials to call its own OpenAPI.
Audit Metadata