Content & Media Creation · genmedia-labs/skills

ai-music

Name: ai-music
Author: genmedia-labs/skills

Generate AI music on RunComfy via the `runcomfy` CLI — a smart router across the music-model catalog. Routes to ElevenLabs AI Music Generation (premium 44.1 kHz stereo vocal tracks, 5 s–5 min, $0.0083/s) and ACE Step / ACE Step 1.5 (StepFun-AI open-weights, tag-driven composition, multilingual lyrics, $0.0002–0.0003/s, ~27× cheaper), plus ACE Step audio-inpaint (regenerate a time range inside an existing track) and ACE Step audio-outpaint (extend a track before or after). Picks the right model for the user's actual intent — premium vocal hook, cheap background music library, multilingual pop song, repair a bad chorus, lengthen a 30 s draft into a 2 min cut — and ships each model's documented prompting patterns plus the minimal `runcomfy run` invoke. Triggers on "generate music", "make a song", "AI music", "background music", "instrumental track", "soundtrack", "jingle", "theme music", "royalty-free music", "compose", "music with lyrics", "extend music", "fix this song", "inpaint music", or any explicit ask to generate or edit music.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

Pure prompt routing playbook: The skill directory contains only a single SKILL.md with zero scripts and zero code. The "engine" is the external RunComfy CLI + Model API; the skill's entire job is enabling the host agent to pick models based on user intent and assemble executable runcomfy run commands.

ai-music/SKILL.md

The agent reads these tables, classifies user intent (premium vs cost-sensitive · multilingual · vocal vs instrumental · generate vs edit), and picks the matching subsection below.

This section serves as the operational core of the entire document: while the preceding model table is static data, the reason it actually works relies on the agent reading the table, classifying intent, and selecting the route; the in-table data combined with the runcomfy run invocation body forms an executable recipe.

Capabilities = coverage across four routes: ElevenLabs generation (premium), ACE Step generation (cheap / open-weight), ACE Step audio-inpaint (modify time ranges), and ACE Step audio-outpaint (extend before or after). Each route includes a schematized --input JSON example.

ai-music/SKILL.md

**ACE Step audio-inpaint** — `acestep-ai/ace-step/audio-inpaint`

The four routes represent "slices of the model catalog": ElevenLabs uses a premium single-prompt channel, ACE Step splits style and lyrics into separate tags and lyrics fields, and editing tasks are exposed via different endpoints of the same CLI.

Intent classification is formatted as an explicit 5-question decision flow (generate vs. edit -> premium -> multilingual -> cost-sensitive -> edit type), allowing different agents to reproduce identical model selection outcomes.

ai-music/SKILL.md

**Premium polish required (brand / commercial)?**

Derived from Question 2 in the '## Decision flow (for the agent)' section; Question 1 routes 'editing' directly to step 5, establishing a generation/editing dichotomy before further branching, effectively formalizing price-quality trade-offs into a decision tree.

Cost metrics are embedded as selection criteria: different models are annotated with $/second, multipliers, and duration caps (5 s–5 min / 5–240 s / cap 4 min), accompanied by recommendation blurbs setting clear "choose this / skip this" boundaries.

ai-music/SKILL.md

**$0.0002/s** — cheapest CLI-reachable music model on RunComfy.

Pricing is hardcoded directly into the prompt ($0.0083/s, 27×, 0.0002–0.0003/s), turning model recommendations into a joint decision on "quality × cost" rather than a simple quality ranking. The downside is that prices may become outdated since the skill cannot auto-update.

The key mechanism for editing capabilities is time-range anchoring: inpaint uses start_time/end_time (which can anchor to the track start or end), while outpaint provides bidirectional extensions via extend_before_duration/extend_after_duration.

ai-music/SKILL.md

Regenerate a **time range** (start_time / end_time, anchorable to track start or end) inside an existing track.

SKILL.md explicitly notes that the CLI currently does not expose mask-based audio inpainting; when faced with such requests, they must be reformulated into time-range edits—clearly defining capability boundaries without overpromising.

Security considerations are author-declared and embedded as operational discipline: installations must use official package managers, tokens must be stored in 0600-permission files, prompts are passed via JSON without shell expansion, and outbound endpoints are strictly allowlisted.

ai-music/SKILL.md

The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**.

'## Security & Privacy' is a standard section in this series of SKILL.md files. It also serves as a declaration of functional boundaries—the skill performs no shell string concatenation, designing the injection surface to be virtually "non-existent" (from a shell perspective).

2Core Capabilities

01Music generation intent routing: automatic triage across premium (ElevenLabs) vs. cheap/open-weight (ACE Step base/1.5) vs. editing (inpaint/outpaint)

02Provides runnable `runcomfy run <vendor>/<model>/<endpoint>` commands and --input JSON skeletons for all four routes

03ACE Step prompting discipline with separated style/lyrics (tags + lyrics with [Verse]/[Chorus]/[inst] tags)

04Localized audio repair: time-range regeneration (audio-inpaint, with anchorable start/end)

05Bidirectional audio extension (audio-outpaint: add intro/outro, cap 4 min, chained invocations required for longer spans)

06Joint cost-quality recommendations: scenario-based pattern library (jingles, batch background music, multilingual versions of the same song, game loops, 30s-to-2min expansion, bad chorus repair, draft-to-final polish)

07Runtime exit code reference table (0/64/65/69/75/77) to assist agents with retry decisions or parameter adjustments

3External Dependencies

Kind	Dependency / Endpoint
cli	@runcomfy/cli（npm 官方 CLI，安装）
cli	runcomfy（login/run 子命令）
network	RunComfy Model API
network	生成结果下载白名单域
network	ElevenLabs AI Music Generation（经 RunComfy 网关）
network	ACE Step / 1.5 text-to-audio + audio-inpaint + audio-outpaint（经 RunComfy 网关）
network	模型目录/文档站（正文链接，供人浏览）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

网络端点: Declares external network access: CLI → model-api.runcomfy.net (submitting and polling model requests)
本地工作目录: File I/O and artifact output: CLI downloads generated audio to --output-dir (e.g., ./out)
SKILL.md: Declares execution via host CLI interpreter or external runtime environment

Audit Notes: The skill itself is a single-file prompt router with zero scripts, zero credential access, and no hidden outbound calls. Execution chain: the host agent calls RunComfy's public paid API via the official third-party npm CLI (@runcomfy/cli). CLI authentication requires reading the user's API token (~/.config/runcomfy/token.json with mode 0600, or RUNCOMFY_TOKEN env), and each runcomfy run consumes paid account credits. Outbound targets are predictable (self-declared allowlist: model-api.runcomfy.net + *.runcomfy.net/*.runcomfy.com, no telemetry/callbacks). Important caveats: 1) Invocations directly incur costs, and embedded $/s rates are snapshots; 2) Third-party source audio can indirectly be injected into generation; 3) The install slug (agentspace-so/runcomfy-agent-skills) differs from the pinned repository (genmedia-labs/skills). Does not exhibit red-tier risks (no security downgrades, scraping, or arbitrary code surfaces). Based on standard classification guidelines ("calling third-party npm/CLI with potential access to secrets/quotas -> orange; if uncertain, choose the higher tier"), it is classified as orange; if the host treats the official CLI's self-contained authentication as an exempt special case, it may be downgraded to yellow.

5Second-Pass Verification

[ok] 外部资源条目复核：npm CLI 安装行、runcomfy login/run 调用点、model-api.runcomfy.net allowlist — 逐条在 SKILL.md 找到原文；runcomfy run 出现 8 次、allowlist 句与 '## How it works' 相互印证。
[ok] '无 shell 注入面'声明反查 — 全文件除 --input JSON 示例与 runcomfy 命令外无其他执行形态；未发现反引号/管道/$( ) 拼接用户输入的指令。
[ok] 隐藏脚本/混淆内容扫描 — 目录仅 SKILL.md（ls -a）；正文代码块全部为 runcomfy 示例 JSON，无混淆/编码载荷。
[discrepancy] 仓库 slug 一致性（安装命令 vs pin 仓库） — SKILL.md 安装行与 See-also 链均指向 agentspace-so/runcomfy-agent-skills，README 自称 runcomfy-agent-skills；而 git remote 与 GitHub API 显示本 pin 为 genmedia-labs/skills。按安装命令安装 ≠ 本分析对象，可能拿到不同/更新的内容。
[unlocatable] 模型 id 与价格的远端真实性 — 模型 endpoint 存在性与 $/s 价格只能在 runcomfy.com/models 平台侧核实，源码仅能确认『skill 如此声明』；不影响本页展示，价格以平台为准。
[ok] 第二遍对安全结论找反例 — 未发现漏掉的网络调用/凭证读取；'Credential' 相关词仅出现在自述安全章（禁止 echo token 等），无实际读取指令。

6Verdict & Scenarios

Single-file, zero-asset design; intent routing and recipes are fully self-contained and immediately ready to use after a single read, featuring an explicit and reproducible decision tree

Cost is treated as a first-class citizen: models are annotated with $/s, cost ratios, and duration caps, complete with clear recommendations and trade-off boundaries

Beyond text-to-music: time-range inpainting and bidirectional outpainting make "fixing a section" and "adding an extension" first-class routes

Built-in security and execution hygiene defined by the author (CLI allowlists, installation bans, token protection, outbound request allowlists)

Best for: Ideal for text-to-music or music-editing agent workflows where the user has a RunComfy account, accepts per-second billing model costs, and needs automatic model selection based on intent and budget. Also well-suited for human users who want ready-to-copy runcomfy run JSON invocation recipes.

Not for: Not suitable for local or self-hosted music generation, or users who do not use RunComfy aggregation; not suitable for workflows requiring mask-level fine audio editing or free trials; not suitable for scenarios requiring the skill to dynamically validate pricing or model availability (data is a static snapshot).

Install Agent-Ready

① Verified Mirror 2026-09-09

Option A · Direct DownloadDownload ai-music.tar.gz

sha256: 88f8e8b389a70680…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit c163a9fd3a.