lit-sheet-music
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a sample MusicXML file from the OpenSheetMusicDisplay official GitHub repository (raw.githubusercontent.com/opensheetmusicdisplay/opensheetmusicdisplay/develop/demo/BrahWiMeSample.musicxml).
- [INDIRECT_PROMPT_INJECTION]: The SheetMusic component provides a surface for processing untrusted data.
- Ingestion points: The component reads data from the src attribute and from an inline element within the parent container inside the getMusic() method in sheet-music.ts.
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded content within the processed XML.
- Capability inventory: The skill utilizes fetch for network operations and innerHTML for DOM access, passing the resulting strings to the opensheetmusicdisplay library for rendering.
- Sanitization: No explicit sanitization or schema validation is performed on the MusicXML content before it is loaded and rendered by the controller.
Audit Metadata