lyria
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill recommends using
ffprobeto verify the duration and technical metadata of generated MP3 files. This is a standard and benign use of a common media analysis utility for output validation. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for creating music generation prompts from user-provided details such as purpose, genre, and instrumentation. This creates an attack surface for indirect prompt injection if user inputs are not properly handled.
- Ingestion points: User input fields for song purpose, duration, genre, and structure in
SKILL.mdandreferences/api-and-prompting.md. - Boundary markers: The skill does not explicitly define delimiters for user-supplied content within the generated prompts.
- Capability inventory: The agent is authorized to perform audio generation via the Google Lyria API and execute local file analysis via
ffprobe. - Sanitization: No specific filtering or escaping rules are defined for the user-provided music parameters.
- [SAFE]: The skill contains multiple references to official technical documentation, pricing guides, and blog posts from well-known and trusted services, specifically within the
google.com,deepmind.google, andgoogle.devdomains.
Audit Metadata