tone

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous shell scripts in references/format-optimization.md and references/model-setup.md for tasks such as audio processing using ffmpeg and configuring local machine learning environments for audio generation.
  • [EXTERNAL_DOWNLOADS]: The documentation in references/model-setup.md provides instructions for installing dependencies using standard tools such as pip, npm, and git. It references official and reputable repositories including facebookresearch/audiocraft and suno-ai/bark. It also includes procedures for adding official GPG keys and repository configurations for well-known services like NVIDIA.
  • [PRIVILEGE_ESCALATION]: The environment setup guides in references/format-optimization.md and references/model-setup.md utilize sudo for installing system-level packages such as ffmpeg and nvidia-container-toolkit. These actions are appropriate and standard for developer-oriented setup tasks described in the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest user descriptions and project context to generate code deliverables. While this constitutes an attack surface for processing untrusted data, the skill mitigates risk through explicit operational boundaries, human-in-the-loop requirements for large batches, and a focus on generating code rather than direct execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 06:56 AM
Security Audit — agent-trust-hub — tone