audio-to-midi
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Uses
subprocess.check_callto automatically install missing Python dependencies viapip. The package names are hardcoded inside the script, preventing arbitrary package injection. - [COMMAND_EXECUTION]: Uses
subprocess.runto invoke thedemucscommand-line utility for audio stem separation. The input file path is validated for existence and supported extensions, and is executed safely as a list element rather than through a shell interpreter. - [DYNAMIC_EXECUTION]: Uses the built-in
__import__()function to dynamically check for the presence of required Python packages at runtime. The module names are strictly limited to a predefined hardcoded list. - [EXTERNAL_DOWNLOADS]: Downloads a pre-trained neural network model weights file (
.pth) for piano transcription from a Zenodo public repository if not found locally. The download URL is hardcoded and directly satisfies the primary functionality of the tool.
Audit Metadata