MIDI Music Composer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 1.7.0

Overview

This skill coherently generates MIDI music and stores local taste preferences, with no evidence of hidden network access, credential use, or destructive behavior.

Install only if you are comfortable with the skill saving local music-preference history, including optional feedback notes, under your home directory. Avoid putting sensitive personal information in feedback unless you intend it to be stored, and delete ~/.hermes/music-composer-preferences.json if you want to reset its learned taste profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill stores persistent preference memory and infers ratings/tags from free-form feedback, but this data collection and profiling behavior is not clearly surfaced in the core purpose statement. In context, this is more dangerous because the skill repeatedly prompts for subjective feedback and then reuses it across sessions, creating silent session-to-session persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill stores persistent preference memory and infers ratings/tags from free-form feedback, but this data collection and profiling behavior is not clearly surfaced in the core purpose statement. In context, this is more dangerous because the skill repeatedly prompts for subjective feedback and then reuses it across sessions, creating silent session-to-session persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill stores persistent preference memory and infers ratings/tags from free-form feedback, but this data collection and profiling behavior is not clearly surfaced in the core purpose statement. In context, this is more dangerous because the skill repeatedly prompts for subjective feedback and then reuses it across sessions, creating silent session-to-session persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill stores persistent preference memory and infers ratings/tags from free-form feedback, but this data collection and profiling behavior is not clearly surfaced in the core purpose statement. In context, this is more dangerous because the skill repeatedly prompts for subjective feedback and then reuses it across sessions, creating silent session-to-session persistence.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill directs the agent to run local Python scripts, read/write manifests, store preferences, and invoke shell commands, but it declares no explicit tool scope or permission boundaries. That creates an avoidable over-privilege condition where the hosting agent may permit broader filesystem and shell access than the user would reasonably expect from a music composition skill.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Overview

Create a short original MIDI composition from a title. The skill turns the title into a stable musical world: genre, tempo, time signature, key, chord progression, instruments, sectional form, and one main melody owner.

Use the bundled generator for candidate artifacts, select the best-scoring candidate, then revise only within the same musical world unless the user asks for a different direction. When the user wants to improve taste, compare versions, or help the critic learn, use blind audition mode.

• Confidence: 80% confidence
• Finding: The skill establishes continuity across interactions by instructing the agent to keep track of prior manifests, stable musical world choices, and learned user taste, which implies session persistence beyond a single request. In context this is moderately risky because the persistence is tied to preference learning and cross-session adaptation, yet the retention boundary is not clearly disclosed to the user.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to record user opinions as persistent preference memory after delivery, but it does not clearly warn users that their feedback will be retained and reused. This is a privacy vulnerability because it enables silent collection of behavioral preference data across sessions under the guise of a simple follow-up question.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: In blind audition mode, the skill stores ratings and optional notes, potentially including free-form personal text, without clearly warning the user that this information becomes persistent preference-learning data. Because blind audition solicits comparative judgments and optional commentary, it can collect richer profiling information than a normal rating flow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a skill for creating MIDI/instrumental song artifacts, but this code also invokes local executables (`fluidsynth` or `timidity`) via subprocesses to render WAV audio. Launching external programs is a materially broader capability than generating MIDI in-process and is not clearly justified by the stated skill purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fluidsynth = shutil.which("fluidsynth")
    timidity = shutil.which("timidity")
    if fluidsynth and soundfont and soundfont.exists():
        subprocess.run(
            [fluidsynth, "-ni", str(soundfont), str(midi_path), "-F", str(wav_path), "-r", "44100"],
            check=True,
            stdout=subprocess.DEVNULL,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
        return wav_path
    if timidity:
        subprocess.run(
            [timidity, str(midi_path), "-Ow", "-o", str(wav_path)],
            check=True,
            stdout=subprocess.DEVNULL,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script persists detailed preference profiling data to a long-lived file under the user's home directory, including liked/disliked genres, instruments, harmony traits, ratings history, critic alignment, and free-form notes. For a music composition skill, this goes beyond transient task fulfillment and creates a behavioral profile without any visible consent flow, retention control, or minimization, which increases privacy risk if the file is later accessed, exfiltrated, or reused for unrelated personalization.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script writes user ratings and free-form opinion text directly to a persistent JSON file without any explicit warning, confirmation, or privacy boundary beyond command-line flags. Free-form notes can contain sensitive personal data, and storing them in plaintext in a predictable location under the home directory increases the chance of unintended disclosure through local access, backups, logs, or later processing by other components.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script persists preference data, free-form notes, and song-rating history to a user profile file under the home directory, creating durable behavioral data unrelated to the core act of generating a MIDI artifact. In this skill context, long-term storage of genres, instruments, opinions, and notes can reveal personal tastes or sensitive free-text content and increases privacy risk if the data is later accessed by other components or an attacker.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code writes user-derived notes and inferred preference data directly to disk without any visible disclosure, consent check, or sanitization boundary, which means users may unknowingly have free-form feedback permanently stored. In a music-composition skill, this is more concerning because the user likely expects artifact generation, not silent profile building, and notes may contain personal information beyond music preferences.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fluidsynth = shutil.which("fluidsynth")
    timidity = shutil.which("timidity")
    if fluidsynth and soundfont and soundfont.exists():
        subprocess.run(
            [fluidsynth, "-ni", str(soundfont), str(midi_path), "-F", str(out_path), "-r", "44100"],
            check=True,
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
        return "fluidsynth"
    if timidity:
        subprocess.run([timidity, str(midi_path), "-Ow", "-o", str(out_path)], check=True)
        return "timidity"
    raise SystemExit("No MIDI renderer found. Install timidity, or fluidsynth plus a soundfont.")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.