lyria

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill recommends using ffprobe to verify the duration and technical metadata of generated MP3 files. This is a standard and benign use of a common media analysis utility for output validation.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for creating music generation prompts from user-provided details such as purpose, genre, and instrumentation. This creates an attack surface for indirect prompt injection if user inputs are not properly handled.
  • Ingestion points: User input fields for song purpose, duration, genre, and structure in SKILL.md and references/api-and-prompting.md.
  • Boundary markers: The skill does not explicitly define delimiters for user-supplied content within the generated prompts.
  • Capability inventory: The agent is authorized to perform audio generation via the Google Lyria API and execute local file analysis via ffprobe.
  • Sanitization: No specific filtering or escaping rules are defined for the user-provided music parameters.
  • [SAFE]: The skill contains multiple references to official technical documentation, pricing guides, and blog posts from well-known and trusted services, specifically within the google.com, deepmind.google, and google.dev domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 07:56 AM