tl-live-music-data
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a well-structured documentation repository for integrating with various legitimate music data APIs. It contains no executable malicious code or behavior override attempts.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill follows security best practices by recommending the use of environment variables for API key management (e.g.,
JAMBASE_API_KEY,DISCOGS_TOKEN) rather than hardcoding credentials. It does not access sensitive local file paths. - [PROMPT_INJECTION]: No prompt injection patterns were found. Notably, the skill includes a dedicated 'Trust Model & IPI Hygiene' section in
SKILL.mdthat explicitly instructs the agent to treat third-party API data as untrusted and provides rules to prevent indirect prompt injection (e.g., ignoring imperative-voice content in scraped data). - [EXTERNAL_DOWNLOADS]: All external domains referenced (such as
musicbrainz.org,jambase.com,setlist.fm, andticketmaster.com) are the official, well-known domains for the respective music and ticketing services documented in the skill. - [DYNAMIC_EXECUTION]: Code snippets provided in the reference files are for illustrative purposes and implementation guidance. They use standard libraries and do not involve unsafe dynamic code execution like
eval()on untrusted input.
Audit Metadata