skills/sonilo-ai/skills/text-to-music/Gen Agent Trust Hub

text-to-music

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill mentions installation instructions for the sonilo and sonilo-cli packages via pip and npm. These are legitimate resources provided by the vendor (sonilo-ai) to interact with their music generation services.- [CREDENTIALS_SAFE]: The skill instructs users to manage authentication through standard environment variables (SONILO_API_KEY) or official login commands, adhering to secure secret management practices rather than hardcoding credentials.- [INDIRECT_PROMPT_INJECTION]: The prompt parameter in the text_to_music tool accepts user-defined text to guide music generation. This is the primary functional interface of the skill. While it processes untrusted input, the scope is restricted to generating audio files via the vendor's API, and the documentation specifies restrictions on copyrighted content.- [COMMAND_EXECUTION]: The skill documents the use of CLI tools and MCP tool calls to trigger music generation. These operations are transparently described and consistent with the skill's stated purpose of providing an interface for the Sonilo service.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 04:09 AM
Security Audit — agent-trust-hub — text-to-music