text-to-music
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions installation instructions for the
soniloandsonilo-clipackages via pip and npm. These are legitimate resources provided by the vendor (sonilo-ai) to interact with their music generation services.- [CREDENTIALS_SAFE]: The skill instructs users to manage authentication through standard environment variables (SONILO_API_KEY) or official login commands, adhering to secure secret management practices rather than hardcoding credentials.- [INDIRECT_PROMPT_INJECTION]: Thepromptparameter in thetext_to_musictool accepts user-defined text to guide music generation. This is the primary functional interface of the skill. While it processes untrusted input, the scope is restricted to generating audio files via the vendor's API, and the documentation specifies restrictions on copyrighted content.- [COMMAND_EXECUTION]: The skill documents the use of CLI tools and MCP tool calls to trigger music generation. These operations are transparently described and consistent with the skill's stated purpose of providing an interface for the Sonilo service.
Audit Metadata