media-midi

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/midictl.py executes external MIDI utilities such as sendmidi, amidi, aconnect, and aseqdump to interact with system MIDI ports.
  • Execution is performed using subprocess.run and subprocess.call with list-based arguments and without the shell=True flag, which is a secure practice to prevent shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill's documentation recommends installing sendmidi and receivemidi via Homebrew (brew install gbevin/tools/sendmidi). These are established, legitimate open-source tools within the music technology community.
  • [DATA_EXPOSURE]: The skill parses and authors Standard MIDI Files (.mid) on the local filesystem. It contains no network-enabled code or patterns suggesting data exfiltration.
  • [PROMPT_INJECTION]: The skill incorporates $ARGUMENTS into its context to process user commands. This is standard functionality for this type of agent skill and does not bypass existing safety protocols.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:53 AM
Security Audit — agent-trust-hub — media-midi