heartmula
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones the source code repository from github.com/HeartMuLa/heartlib.
- [EXTERNAL_DOWNLOADS]: Downloads large model checkpoints from HuggingFace repositories under the HeartMuLa organization.
- [COMMAND_EXECUTION]: Requires execution of several shell commands for environment setup, package installation via uv pip, and running the generation script.
- [DYNAMIC_EXECUTION]: Instructs the agent or user to perform manual code modification (patching) on modeling_heartmula.py and music_generation.py to handle RoPE cache initialization and tensor dimension mismatches.
- [INDIRECT_PROMPT_INJECTION]: The generation pipeline ingests external files (lyrics.txt and tags.txt). The skill lacks defined boundary markers or sanitization for this content. While primarily impacting audio generation, the skill possesses capabilities for file writing and command execution within the same environment.
Audit Metadata