media-midi
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/midictl.pyexecutes external MIDI utilities such assendmidi,amidi,aconnect, andaseqdumpto interact with system MIDI ports. - Execution is performed using
subprocess.runandsubprocess.callwith list-based arguments and without theshell=Trueflag, which is a secure practice to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill's documentation recommends installing
sendmidiandreceivemidivia Homebrew (brew install gbevin/tools/sendmidi). These are established, legitimate open-source tools within the music technology community. - [DATA_EXPOSURE]: The skill parses and authors Standard MIDI Files (.mid) on the local filesystem. It contains no network-enabled code or patterns suggesting data exfiltration.
- [PROMPT_INJECTION]: The skill incorporates
$ARGUMENTSinto its context to process user commands. This is standard functionality for this type of agent skill and does not bypass existing safety protocols.
Audit Metadata