whistlegraph-pop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited whistlegraph-pop (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turns a whistled TikTok into a musical readout you can compose a /pop track from. Tooling lives in toolchain/whistlegraph/ (see its README).
--latest N from the@whistlegraph account):
node toolchain/whistlegraph/grab.mjs <tiktok-url>This downloads the mp4, extracts a mono WAV, and runs analyze.py (pop .venv librosa) → tempo, key/scale, whistled-melody note sequence, onsets → downloads/<id>.analysis.json + INDEX.json.
whistle, so expect neighbor-note jitter (the centsOff column shows the glides) — read the skeleton, not every blip. Identify the hook, its repeats (titles like "… x2" mean the phrase repeats), the longest held notes (structural anchors), and the cadence.
key, tempoBPM, and melody[] to composebottom-up from AC instruments — never Suno end-to-end (see pop/SCORE.md, pop/lib/). The whistled line is the lead/topline.
*.mp4/*.wav are gitignored (reproducible from URL); *.analysis.jsonand INDEX.json are tracked.
node toolchain/whistlegraph/grab.mjs --list summarizes the corpus.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.