bpm finder
v1.0.0Use this skill when the user needs BPM finder help inside Codex, including tap tempo estimation, BPM conversion, tempo normalization, lightweight tempo analy...
⭐ 0· 215·0 current·0 all-time
by@wsgtcyx
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the behavior: the skill provides tap-interval/timestamp math and local audio-file BPM estimation using a bundled Node CLI. Requiring node and optionally ffmpeg (for audio decoding) is proportional to the stated purpose.
Instruction Scope
SKILL.md limits actions to local tempo math, running scripts/tap-tempo.js for taps or audio files, and routing complex tasks to the website. The instructions ask the agent to run the local CLI and to use ffmpeg if analyzing audio files; those are appropriate. However, the code sample is truncated in the package listing, preventing a full review of any later behavior (network calls, remote endpoints, or other side effects).
Install Mechanism
No install spec is present (instruction-only plus a bundled script). That is low-risk compared to remote downloads. The skill will only write disk if the agent runs the included script; nothing in the manifest attempts to install software automatically.
Credentials
The skill requests no environment variables, credentials, or config paths. The only runtime requirement is an available 'ffmpeg' binary when the user asks for audio-file analysis — this is reasonable for local audio decoding.
Persistence & Privilege
always is false and there's no indication the skill wants persistent/automatic installation or to modify other skills or system-wide settings. Autonomous invocation is allowed by default but not combined with broad privileges here.
What to consider before installing
This skill is conceptually coherent: it performs tempo math and local audio analysis with a bundled Node script. Before installing or running it, review the complete scripts/tap-tempo.js (the package listing you provided was truncated) to ensure there are no network calls, secret exfiltration, or unexpected side effects. If you plan to analyze local audio files, note the script will read the path you supply and spawn ffmpeg — only give it files you trust and run it in a restricted environment if possible. If you cannot inspect the full file, treat this package as unverified and avoid giving it sensitive file paths or running it with elevated privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk974mxw6bx54285qgp938sq5fs82eyz5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.