skywork-music-maker
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill communicates with the official Mureka AI API at
api.mureka.aiusing standard HTTPS requests to perform its core music generation tasks. - [SAFE]: Credentials are managed securely; the skill instructs users to set the
MUREKA_API_KEYenvironment variable and does not contain hardcoded secrets or unsafe storage practices. - [SAFE]: File system interactions are limited to creating output directories and saving generated audio and lyric files as requested by the user, with no access to sensitive system paths.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided natural language descriptions and lyrics to generate API prompts and local text files.
- Ingestion points: Music descriptions and song lyrics provided via CLI arguments to
scripts/mureka.py. - Boundary markers: The instructions recommend using structural tags like
[Verse]and[Chorus], which serve as content delimiters but are not cryptographic or security boundaries. - Capability inventory: The skill's capabilities are restricted to network communication with the Mureka API and local file writes within the specified output folder.
- Sanitization: Content is passed directly to the API and file system without additional sanitization, which is typical for the intended functionality of music and text generation.
Audit Metadata