The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/transcribe.py automatically downloads a pre-trained piano transcription model file (~165MB) from zenodo.org when the piano engine is utilized. Zenodo is a well-known research repository, and the file is stored in the user's home directory (~/piano_transcription_inference_data).
[COMMAND_EXECUTION]: The script uses subprocess.check_call to invoke the pip package manager for installing missing dependencies. It also uses subprocess.run to execute the demucs command-line tool. These actions allow the skill to execute system-level commands to modify the environment and perform audio processing tasks.
[REMOTE_CODE_EXECUTION]: The script dynamically installs and then imports multiple third-party packages from PyPI (including basic-pitch, music21, and piano_transcription_inference) using the __import__ function. Loading and executing code from external repositories at runtime poses a supply-chain risk if any of the requested packages were compromised or targeted via typosquatting.
[PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes user-provided audio files, the content of which is then transcribed into text-based formats (MIDI, MusicXML, and analysis JSON) and returned to the agent.
Ingestion points: Audio files in various formats (MP3, WAV, FLAC, OGG, M4A, AAC, WMA) processed by scripts/transcribe.py.
Boundary markers: Absent. There are no instructions or delimiters implemented to prevent the agent from potentially following instructions if they were transcribed from the audio content.
Capability inventory: File system writes, network downloads (urllib.request.urlretrieve), and shell command execution (pip, demucs).
Sanitization: None. The skill does not validate or sanitize the audio content or the resulting transcription metadata before it is processed or presented to the agent.

audio-to-midi