Voice Note To Midi

• Outcome: Pass
• Latest audit: May 27, 2026, 9:36 PM
• Version:
  0.1.0

Overview

This appears to be a straightforward audio-to-MIDI skill, with ordinary installer risks around third-party dependencies and an optional PATH change.

Before installing, review the Basic Pitch hum2midi script if you need to download it manually, and consider pinning or reviewing the Python dependencies on sensitive machines. Only accept the PATH change if you are comfortable having ~/melody-pipeline affect future terminal command lookup; remove the added export line from your shell profile to undo it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script persistently modifies the user's shell startup file to add the install directory to PATH, which changes the user's execution environment beyond the immediate setup task. While this is a common convenience feature in installers, it can create lasting trust and execution-surface changes, especially if that directory later contains replaced or malicious executables.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The instructions append an export line to ~/.bashrc, creating a persistent environment change without clearly warning the user that future shells will be affected. This is not inherently malicious here, but silent persistence can surprise users, interfere with existing PATH ordering, and make rollback harder.

VirusTotal

65/65 vendors flagged this skill as clean.