mm-music-expert
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing external user data that is interpolated into prompts for the MiniMax API.
- Ingestion points: User-provided lyrics and style prompts defined in the workflow sections of SKILL.md.
- Boundary markers: None identified in the prompt construction logic or the CLI script.
- Capability inventory: The skill performs network operations (POST/GET) and file write operations in scripts/generate_music.py and scripts/utils_audio.py.
- Sanitization: No specific input sanitization is performed on the lyrics or prompt strings before submission to the external API.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch generated audio files from the MiniMax API endpoint.
- The scripts/generate_music.py script submits generation tasks to api.minimaxi.com and polls for completion.
- The scripts/utils_audio.py script downloads the resulting audio content from the URL provided by the vendor response.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (scripts/generate_music.py) to coordinate the music generation process, which is a legitimate and documented use case.
Audit Metadata