sound-effects
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The setup script (
setup_env.sh) installs the 'uv' package manager by piping a script fromastral.shto the shell. Astral is a well-known technology provider, and this installation method is their standard practice. - [EXTERNAL_DOWNLOADS]: The skill downloads pre-converted MLX model weights from Hugging Face. Hugging Face is a well-known service for hosting machine learning models.
- [COMMAND_EXECUTION]: The skill executes
ffmpegto encode generated audio into MP3 format and runs themlx-audiogentool to perform sound synthesis. These commands are executed locally using structured arguments to prevent shell injection. - [PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted user data by accepting text prompts to generate audio clips. The risk of indirect prompt injection is low, as the data is used as input for a sound synthesis model and is not interpreted as executable instructions. The implementation uses safe subprocess handling for all external calls.
Audit Metadata