lyria

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the ffprobe utility to validate the technical properties (codec, duration, sample rate) of generated audio files. This is a legitimate and safe use of a local media tool for quality assurance.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for music generation, ingesting user-provided text, lyrics, and images, which constitutes an indirect prompt injection surface.
  • Ingestion points: SKILL.md (user prompts) and references/api-and-prompting.md (text and image inputs for the API).
  • Boundary markers: The skill uses detailed prompt templates to structure output, though it does not implement explicit delimiters or 'ignore' warnings for the input data.
  • Capability inventory: Shell execution of ffprobe and network requests to the Google Gemini API.
  • Sanitization: No explicit sanitization or filtering of the user-provided music descriptions or lyrics is specified prior to being passed to the model.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:31 PM