Voice Note To Midi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:03 AM UTC
• Version: 0.1.0

Overview

The skill is for local audio-to-MIDI conversion, but its required executable is missing and users are directed toward an unverified mutable remote script.

Review before installing. The documented local audio-processing behavior is not itself malicious, but the package is incomplete without hum2midi and may lead you to run unverified code from GitHub. Install only if you are comfortable auditing or pinning the external hum2midi source and Python dependencies, and avoid adding it to your shell PATH unless you want a persistent user-level change.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:75

Finding

Unpinned Python dependencies allow uncontrolled supply-chain changes

Content

View full analysis

Vulnerability Details

File Location: setup.sh:75-83
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install --upgrade pip
pip install basic-pitch librosa soundfile mido

# Install optional music21 for advanced key detection
echo ""
echo "Install music21 for enhanced key detection? [Y/n]"
read -r response
if [[ ! "$response" =~ ^([nN][oO]|[nN])$ ]]; then
    pip install music21

The manual installation instructions repeat this unsafe dependency-installation pattern in SKILL.md:95:

bash

pip install basic-pitch librosa soundfile mido music21

Technical Analysis

The installer retrieves the latest versions of multiple packages without pinning exact versions or verifying cryptographic hashes. It also upgrades pip to an unspecified version. Consequently, the effective code installed and executed can change over time without any corresponding change to this reviewed project.

Python packages may execute package-controlled build or installation logic during installation. A compromised package release, compromised package index, dependency-confusion condition, or malicious transitive dependency could therefore execute code under the account running setup.sh. Lack of a lock file also prevents reproducible dependency resolution and makes it difficult to establish which code was audited.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or the relevant package-distribution channel.
2. The attacker publishes a malicious release that remains compatible with the unconstrained package requirement.
3. A user runs setup.sh or follows the manual installation command in SKILL.md.
4. pip resolves and downloads the attacker-controlled release because no version or hash restrictions apply.
5. Malicious installation or runtime code executes with the permissions of the installing use ...[truncated 575 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency lock file containing exact versions for all direct and transitive dependencies.

2. Record cryptographic hashes for every distribution and install with pip --require-hashes.

3. Replace the unconstrained commands with a command such as:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Pin the installer tooling instead of implicitly upgrading pip to the latest release.

5. Generate lock files in a controlled environment and review dependency changes before updating them.

6. Use a trusted package index explicitly and apply controls against dependency confusion where private dependencies are introduced.

7. Update SKILL.md so its manual installation instructions use the same locked and hash-verified dependency set.

8. Consider installing with network restrictions and minimum required user privileges.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: setup.sh:99

Finding

Installer recommends executing a mutable remote script without integrity verification

Content

View full analysis

Vulnerability Details

File Location: setup.sh:99-102
Vulnerability Type: Unverified remote payload retrieval
Risk Level: Medium

Vulnerable Code

bash

else
    echo "⚠ Please download the hum2midi script manually:"
    echo "  wget https://raw.githubusercontent.com/basic-pitch/basic-pitch/main/hum2midi -O $INSTALL_DIR/hum2midi"
    echo "  chmod +x $INSTALL_DIR/hum2midi"
fi

Technical Analysis

When the package does not contain hum2midi and no copy is already installed, setup.sh prints instructions that tell the user to download a script from the mutable main branch of an external repository and mark it executable.

The setup script does not itself execute wget; user action is required. Nevertheless, the recommended installation path has no immutable commit reference, release version, checksum, or signature verification. The retrieved executable can therefore change after this project has been reviewed. A compromise of the upstream repository or hosting account—or an unintended upstream branch change—could replace the expected program with arbitrary code.

The artifact being audited does not include the advertised hum2midi implementation, so the behavior of the remotely retrieved executable cannot be assessed from this project.

Attack Path

1. The expected local hum2midi file is absent.
2. An attacker compromises the upstream repository, its maintainers, or its content-distribution path and modifies main/hum2midi.
3. A user follows the command printed by setup.sh.
4. wget saves the current remote content as $INSTALL_DIR/hum2midi without verifying its identity or integrity.
5. The user grants execute permission with chmod +x.
6. The user follows the setup script's subsequent instruction to run ./hum2midi --help or uses the program on an audio file.
7. The substituted payload executes with the user's privileges.

Impact Assessment

A malicious remote ...[truncated 521 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete hum2midi implementation in the project so it can be reviewed together with the installer.

2. If remote retrieval is necessary, use an immutable commit identifier or signed release rather than the mutable main branch.

3. Publish an independently reviewed SHA-256 digest and verify it before granting execute permission:

   bash

   wget "https://example.invalid/immutable-release/hum2midi" -O "$INSTALL_DIR/hum2midi"
   echo "EXPECTED_SHA256  $INSTALL_DIR/hum2midi" | sha256sum --check --strict -
   chmod 0755 "$INSTALL_DIR/hum2midi"
   

4. Abort installation if integrity verification fails.

5. Prefer signed release artifacts and verify the signature against a pinned, trusted signing key.

6. Document the exact upstream source revision included in each project release.

7. Do not instruct users to execute downloaded content until its provenance and integrity have been validated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

./setup.sh

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

osa, music21, etc.)

• Download and configure the hum2midi script
• Add melody-pipeline to your PATH

Manual Install:

If you prefer manual setup:

bash

mkdir -p ~/melody-pipeline
cd ~/melody-pipeline
python3 -m venv venv-bp
source venv-bp/bin/activate
pip install basic-pitch librosa soundfile mido music21
chmod +x ~/melody-pipeline/hum2midi

5. Add to your PATH (optional):

bash

echo 'export PATH="$HOME/melody-pipeline:$PATH"' >> ~/.bashrc
source ~/.bashrc

Verify Installation

bash

cd ~/melody-pipeline
./hum2midi --help

Usage

Basic Usage

Convert a voice memo to MIDI:

bash

./hum2midi my_humming.wav

This creates my_humming.mid with 16th-note quantization.

Specify Output File

bash

./hum2midi input.wav output.mid

Command-Line Options

Option	Description	Default
--grid <value>	Quantization grid: 1/4, 1/8, 1/16, 1/32	1/16
--min-note <ms>	Minimum note d

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents shell-based setup and execution steps but does not declare any explicit tool scope or permissions. This creates a trust and review gap: an agent or user may invoke shell-capable behavior implied by the skill without clear upfront boundaries, increasing the chance of unintended command execution during installation or use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The setup process creates and populates a persistent directory under the user's home folder and installs tooling there for later reuse. Persistence itself is not inherently malicious here, but in a skill context it increases risk because it leaves executables and environment changes on the system beyond the immediate task, which can widen the blast radius of mistakes or future compromise.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

This automated script will:
- Check Python 3.11+ is installed
- Create the `~/melody-pipeline` directory
- Set up the virtual environment
- Install all dependencies (basic-pitch, librosa, music21, etc.)
- Download and configure the hum2midi script

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions append to ~/.bashrc and source it, which makes a persistent change to the user's shell environment without prominently warning that this affects future sessions. While common in developer tooling, silent persistence can surprise users and make rollback harder, especially in agent-driven or semi-automated execution contexts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.