midi-synth
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
ensure_depsfunction in bothscripts/render.pyandscripts/to_strudel.pyusespipto download and install third-party packages (pretty_midi,numpy,soundfile) directly from PyPI at runtime if they are not detected on the system. - [EXTERNAL_DOWNLOADS]: As documented in
soundfonts/README.md, the skill is designed to automatically download binary SoundFont (.sf2) files from external sources such as archive.org to enable audio rendering functionality. - [COMMAND_EXECUTION]: The skill invokes several external command-line utilities using the
subprocessmodule, includingpipfor runtime dependency management,fluidsynthfor MIDI rendering, andffmpegfor audio format conversion to MP3. - [REMOTE_CODE_EXECUTION]: The scripts utilize the
__import__()function to dynamically load modules at runtime, which is a form of dynamic code loading used here to verify the presence of required libraries after installation.
Audit Metadata