acestep
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by invoking a local script,
tools/music_gen.py, which manages the interface with the music generation model and audio processing logic. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external and user-supplied data to generate audio content.
- Ingestion points: The skill ingests text via
--promptand--lyricsarguments, and audio files via--inputand--referencearguments. - Boundary markers: There are no specific delimiters or instruction-ignore markers defined in the documentation for handling untrusted inputs.
- Capability inventory: The skill triggers a local Python script capable of interacting with the RunPod API and the local file system for audio output.
- Sanitization: The documentation does not specify sanitization routines for the input text or audio metadata.
Audit Metadata