skills/reason-machines/devtools-skills/justanothermusicclient-tauri-youtube-music/Gen Agent Trust Hub
justanothermusicclient-tauri-youtube-music
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Rust toolchain by piping a script from 'https://sh.rustup.rs' to the shell. This is the official, industry-standard installation method for the Rust programming language.
- [COMMAND_EXECUTION]: The skill provides commands for environment setup using system package managers ('apt', 'xcode-select') and project build tools ('npm', 'cargo'). These are standard developer operations required for building the application from source.
- [DYNAMIC_EXECUTION]: The application architecture utilizes 'webview.eval()' to inject JavaScript into the YouTube Music interface. This is a standard design pattern for Tauri applications that need to interact with external web content they wrap.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data by extracting state (title, artist, player-state) from the YouTube Music web page.
- Ingestion points: Extraction of playback state via JavaScript injection in the YouTube Music WebView (described in SKILL.md).
- Boundary markers: None identified in the provided snippets.
- Capability inventory: File system access ('writeTextFile', 'createDir'), Network connectivity ('connect-src'), and Window management ('appWindow').
- Sanitization: None identified; the skill assumes the structure of the YouTube Music DOM is trusted for its primary purpose.
Audit Metadata