midi-synth

Warn

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The ensure_deps function in both scripts/render.py and scripts/to_strudel.py uses pip to download and install third-party packages (pretty_midi, numpy, soundfile) directly from PyPI at runtime if they are not detected on the system.
  • [EXTERNAL_DOWNLOADS]: As documented in soundfonts/README.md, the skill is designed to automatically download binary SoundFont (.sf2) files from external sources such as archive.org to enable audio rendering functionality.
  • [COMMAND_EXECUTION]: The skill invokes several external command-line utilities using the subprocess module, including pip for runtime dependency management, fluidsynth for MIDI rendering, and ffmpeg for audio format conversion to MP3.
  • [REMOTE_CODE_EXECUTION]: The scripts utilize the __import__() function to dynamically load modules at runtime, which is a form of dynamic code loading used here to verify the presence of required libraries after installation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 15, 2026, 06:56 AM
Security Audit — agent-trust-hub — midi-synth