text-to-music
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install the 'sonilo' and 'sonilo-cli' packages via standard package managers (pip and npm). These packages are official tools provided by the vendor, sonilo-ai, to facilitate interaction with their music generation service.
- [COMMAND_EXECUTION]: The skill provides examples of using the 'sonilo' CLI and 'curl' to send requests to the Sonilo REST API. These execution patterns are intended for the skill's core functionality and target the vendor's official domain (api.sonilo.com).
- [INDIRECT_PROMPT_INJECTION]: The 'prompt' parameter in the 'text_to_music' tool serves as an ingestion point for natural language instructions. * Ingestion points: The 'prompt' argument defined in the 'text_to_music' tool within SKILL.md. * Boundary markers: The skill does not define or recommend the use of delimiters or 'ignore' instructions to isolate user-supplied prompt text from potential instructions embedded in processed data. * Capability inventory: The skill possesses the ability to perform network requests (to the Sonilo API) and write files to the local file system (saving generated audio tracks) using provided tools and CLI commands. * Sanitization: The instructions do not describe any sanitization, filtering, or validation steps for the prompt content before it is transmitted to the generation backend.
Audit Metadata