heartmula
Warn
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Clones project source code from an external GitHub repository (
https://github.com/HeartMuLa/heartlib.git). - [EXTERNAL_DOWNLOADS]: Downloads large model weights and checkpoints from Hugging Face repositories (
HeartMuLa/HeartMuLaGen,HeartMuLa/HeartMuLa-oss-3B-happy-new-year,HeartMuLa/HeartCodec-oss-20260123) using thehf downloadcommand. - [COMMAND_EXECUTION]: Executes shell commands to set up a Python virtual environment and install dependencies (
uv venv,uv pip install). - [COMMAND_EXECUTION]: Instructs the agent to manually modify (patch) downloaded Python source files (
src/heartlib/heartmula/modeling_heartmula.pyandsrc/heartlib/pipelines/music_generation.py) to resolve compatibility issues betweentransformersandtorchtunelibraries. - [COMMAND_EXECUTION]: Runs a local Python script (
python ./examples/run_music_generation.py) to perform music generation, which involves loading and executing code from the previously cloned repository.
Audit Metadata