skills/openclaw/skills/guitar-chord/Gen Agent Trust Hub

guitar-chord

Warn

Audited by Gen Agent Trust Hub on Mar 21, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script chord_identifier.py uses subprocess.run to execute cargo run within a hardcoded directory (~/workspace/ascii_chord) to generate chord diagrams. Executing a build tool like cargo on an external project introduces an unverified boundary where arbitrary code could be executed through build scripts or the resulting binary.\n- [EXTERNAL_DOWNLOADS]: The tool relies on the cargo build system, which fetches necessary dependencies from the official crates.io registry during the build process.\n- [COMMAND_EXECUTION]: The Python script is functionally incomplete; the notes_to_semitones function is called in the main execution block but its definition is missing from the script, leading to a NameError and failure during reverse chord lookups.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 21, 2026, 12:42 AM