skywork-music-maker

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill communicates with the official Mureka AI API at api.mureka.ai using standard HTTPS requests to perform its core music generation tasks.
  • [SAFE]: Credentials are managed securely; the skill instructs users to set the MUREKA_API_KEY environment variable and does not contain hardcoded secrets or unsafe storage practices.
  • [SAFE]: File system interactions are limited to creating output directories and saving generated audio and lyric files as requested by the user, with no access to sensitive system paths.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided natural language descriptions and lyrics to generate API prompts and local text files.
  • Ingestion points: Music descriptions and song lyrics provided via CLI arguments to scripts/mureka.py.
  • Boundary markers: The instructions recommend using structural tags like [Verse] and [Chorus], which serve as content delimiters but are not cryptographic or security boundaries.
  • Capability inventory: The skill's capabilities are restricted to network communication with the Mureka API and local file writes within the specified output folder.
  • Sanitization: Content is passed directly to the API and file system without additional sanitization, which is typical for the intended functionality of music and text generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:23 AM