music-generation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided musical style descriptions and lyrics, which are then used as parameters for external music generation APIs.
- Ingestion points: User prompts and style inputs defined in 'SKILL.md'.
- Boundary markers: None; the skill relies on the agent's logic to transform and sanitize user requests.
- Capability inventory: Network requests to third-party music providers and local audio file creation in 'scripts/lyria.py', 'scripts/suno.py', and 'scripts/udio.py'.
- Sanitization: None; safety checks are deferred to the upstream API providers.
- [DATA_EXFILTRATION]: The scripts 'suno.py' and 'udio.py' perform network operations to 'api.suno.ai' and 'api.udio.com'. While these are legitimate targets for the skill's purpose, they are not on the platform's default domain whitelist.
- [COMMAND_EXECUTION]: The 'lyria.py' script invokes the 'gcloud' CLI tool using 'subprocess.run' to retrieve the current project configuration. This is a benign environmental check with no user-controlled data flow into the command arguments.
Audit Metadata