midi-generation

Pass

Audited by Gen Agent Trust Hub on Jun 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script skills/convert_to_wav.py utilizes subprocess.run() to invoke the fluidsynth system utility for converting MIDI files to WAV audio. The implementation uses a list-based argument structure rather than a raw shell string, which is a standard security practice to prevent shell injection. Furthermore, filenames passed to this utility are sanitized in skills/generate_midi.py using regular expressions to remove potentially dangerous characters.
  • [EXTERNAL_DOWNLOADS]: The README.md and SKILL.md files provide instructions for the user to download the A320U.sf2 SoundFont from musical-artifacts.com. This is a well-known community repository for musical artifacts and is required for the audio synthesis functionality of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 6, 2026, 10:33 PM
Security Audit — agent-trust-hub — midi-generation