elevenlabs-music-generation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
runcomfyCLI tool via the Bash tool to generate music and manage authentication. - [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the
@runcomfy/cliNode.js package from the official npm registry to enable its functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input which could be used to influence the music generation process or agent behavior.
- Ingestion points: The
promptfield in the input JSON, which accepts user-provided style descriptions and lyrics. - Boundary markers: Content is encapsulated as a string within a JSON object passed to the CLI tool.
- Capability inventory: The skill can execute the
runcomfyCLI tool, which performs network operations tomodel-api.runcomfy.netand writes generated audio files to the local file system. - Sanitization: The documentation specifies that the CLI transmits the JSON body directly to the API without shell expansion, mitigating command injection risks at the CLI level, though the content is still interpreted by the generative model.
Audit Metadata