Hum2Song
v3.0.4Hum2Song turns a hummed or sung melody into a complete song with local audio processing, MIDI extraction, and optional AI-assisted arrangement, without uploa...
⭐ 0· 167·1 current·1 all-time
byhaidong@harrylabsj
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (local audio → MIDI → song) align with the included script and SKILL.md. Required tools (basic_pitch, pretty_midi, librosa, soundfile, fluidsynth/ffmpeg, optional ACE‑Step) are appropriate for the stated task and nothing unrelated (cloud creds, networking tokens, or unrelated system access) is requested.
Instruction Scope
Runtime instructions and the script operate on local files and libraries and explicitly state "no external API calls by default." The optional ACE‑Step flow will download model weights on first use (~4GB) as documented — this is outside the local-only guarantee in the sense that it uses network to fetch weights, but the SKILL.md explicitly warns and frames this as user-initiated. The script appends ~/ace-step to sys.path before importing ACE‑Step; importing code from that directory will execute whatever is present there, so users should only place trusted code in ~/ace-step or clone from a trusted repository.
Install Mechanism
There is no automated install spec bundled; SKILL.md gives manual install instructions (brew/apt, pip, optional git clone). This is low-risk. The only high-bandwidth download risk is the ACE‑Step model weights (~4GB) which the SKILL.md and references describe as downloaded on first use. All installs are user-initiated (pip/git).
Credentials
The skill requests no environment variables, credentials, or special config paths. It reads/writes typical user files (temporary work dir, ~/Music by default) — this is proportional for a local processing tool.
Persistence & Privilege
The skill is not always-enabled and does not request elevated privileges or modify other skills or global agent settings. It runs as a normal user script and only writes its own temporary/output files.
Assessment
This skill appears coherent and implements a local humming→MIDI→synthesis pipeline. Before installing/running, consider:
- Install dependencies in a dedicated virtualenv to avoid system-wide changes (pip install basic-pitch pretty_midi librosa soundfile numpy).
- The ACE‑Step option is optional; if you enable it you will (a) git clone the repository and (b) on first run the model may download ~4GB of weights — verify you have disk space and bandwidth and that you trust the ACE‑Step source. The script adds ~/ace-step to sys.path and imports it; importing untrusted code from that directory can execute arbitrary code, so only clone from a trusted repo.
- SoundFont synthesis requires an SF2 file; ensure you trust the SoundFont file source and path. If no SF2 is found the script falls back to default synthesis.
- The tool writes output to ~/Music by default and uses temp directories; check file locations and permissions if that matters.
- Although this skill does not call external APIs by default, third-party libraries or optional components may perform network actions (model weight fetches). Review any third-party projects (ACE‑Step, basic-pitch) you install if you need a stricter privacy posture.
If you accept those points (especially trusting optional model sources), the skill is reasonable to use.Like a lobster shell, security has layers — review code before you run it.
audiovk977epb19cg6m95r67hqgj3fa1843vhphummingvk977epb19cg6m95r67hqgj3fa1843vhplatestvk977epb19cg6m95r67hqgj3fa1843vhplocal-processingvk977epb19cg6m95r67hqgj3fa1843vhpmidivk977epb19cg6m95r67hqgj3fa1843vhpmusicvk977epb19cg6m95r67hqgj3fa1843vhpsong-generationvk977epb19cg6m95r67hqgj3fa1843vhp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.