sound-effects

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The setup script (setup_env.sh) installs the 'uv' package manager by piping a script from astral.sh to the shell. Astral is a well-known technology provider, and this installation method is their standard practice.
  • [EXTERNAL_DOWNLOADS]: The skill downloads pre-converted MLX model weights from Hugging Face. Hugging Face is a well-known service for hosting machine learning models.
  • [COMMAND_EXECUTION]: The skill executes ffmpeg to encode generated audio into MP3 format and runs the mlx-audiogen tool to perform sound synthesis. These commands are executed locally using structured arguments to prevent shell injection.
  • [PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted user data by accepting text prompts to generate audio clips. The risk of indirect prompt injection is low, as the data is used as input for a sound synthesis model and is not interpreted as executable instructions. The implementation uses safe subprocess handling for all external calls.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 09:08 PM
Security Audit — agent-trust-hub — sound-effects