tl-live-music-data
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill proactively addresses the risk of indirect prompt injection from third-party APIs and scraped content. It defines a detailed trust model (Tiers A, B, and C) and mandatory handling rules, such as data-only consumption, prohibiting scope escalation, and requiring user confirmation for writes. This is a defensive security feature designed to ensure the agent treats external data as values rather than instructions.
- [SAFE]: All external URLs and references in the documentation point to official developer portals for music services (e.g., MusicBrainz, JamBase, Setlist.fm, Spotify, Ticketmaster) or the author's own GitHub repository. The shell commands provided in the examples (e.g., firecrawl, curl) are standard instructional content for using the documented APIs and do not represent silent or malicious code execution.
- [SAFE]: The skill implements best practices for secret management by providing placeholders for environment variables (e.g., JAMBASE_API_KEY, SETLISTFM_API_KEY) and explicit instructions for local storage and caching logic, rather than hardcoding sensitive credentials.
Audit Metadata