ClawHub
Back to skill

Security audit

Voice Note To Midi

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local audio-to-MIDI installer with ordinary dependency and PATH-change risks, not evidence of malicious behavior.

Review the Basic Pitch hum2midi script before downloading it manually, and consider pinning or reviewing Python dependencies on sensitive machines. Only accept the PATH change if you are comfortable letting ~/melody-pipeline affect future command lookup; remove the added export line from your shell profile to undo it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The setup script offers to persistently modify the user's shell startup file by appending the install directory to PATH. While this is a common convenience pattern, it creates lasting execution-path changes outside the immediate needs of installation and can cause unintended command shadowing if executables are later placed in that directory. In this skill's context, the persistence is not strictly necessary for audio-to-MIDI conversion, so the finding is valid, though the risk appears limited and likely not malicious.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The instructions append to ~/.bashrc, creating a persistent environment change that affects future shells. While the specific PATH modification appears benign, doing this without an explicit warning can cause user confusion, accidental PATH shadowing, or make later troubleshooting harder.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.