audio-to-midi

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Uses subprocess.check_call to automatically install missing Python dependencies via pip. The package names are hardcoded inside the script, preventing arbitrary package injection.
  • [COMMAND_EXECUTION]: Uses subprocess.run to invoke the demucs command-line utility for audio stem separation. The input file path is validated for existence and supported extensions, and is executed safely as a list element rather than through a shell interpreter.
  • [DYNAMIC_EXECUTION]: Uses the built-in __import__() function to dynamically check for the presence of required Python packages at runtime. The module names are strictly limited to a predefined hardcoded list.
  • [EXTERNAL_DOWNLOADS]: Downloads a pre-trained neural network model weights file (.pth) for piano transcription from a Zenodo public repository if not found locally. The download URL is hardcoded and directly satisfies the primary functionality of the tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:07 AM