Tmp.YcDFPWUNnt

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 0.14.0

Overview

The skill is purpose-aligned for MuseScore workflows, but it asks users to run unverified external components through a signed-in browser session.

Install only if you trust the private MCP server and fetchproxy extension provider. Prefer project-scoped MCP configuration, inspect and pin the exact server and extension versions, and consider using a separate browser profile or MuseScore account because requests run through a signed-in tab.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned and Unverifiable MCP Server and Browser Extension Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-40
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Evidence

md

- **Source:** [github.com/chrischall/musescore-mcp](https://github.com/chrischall/musescore-mcp) (private)

> ⚠️ MuseScore has no public consumer API (the old one was shut down). This
> server reads the same server-rendered data the musescore.com web app
> hydrates from, dispatched through your own signed-in browser tab via the
> fetchproxy extension. Use at your own discretion.

## Setup

### 1. Install musescore-mcp

`.mcp.json` (project) or `~/.claude/mcp.json` (global):

```json
{
  "mcpServers": {
    "musescore": {
      "command": "node",
      "args": ["/absolute/path/to/musescore-mcp/dist/bundle.js"]
    }
  }
}

2. Install the fetchproxy extension and sign in

Install the fetchproxy browser extension and open musescore.com signed in, with the Cloudflare check cleared. Every request rides that tab's session.

text

### Technical Analysis

The Skill directs users to execute a local Node.js bundle from a private repository and install a browser extension from an external repository. Neither component is included in the audited project, and the documentation does not pin either dependency to an immutable commit, signed release, version, or integrity hash.

The private MCP implementation therefore cannot be independently reviewed from this artifact. The behavior of both dependencies can also change after the Skill itself has been audited. This creates a supply-chain trust boundary in which the effective implementation is controlled outside the reviewed package.

The browser extension is particularly sensitive because requests are routed through a signed-in MuseScore tab. Although the documentation states that authentication remains in the browser, the extension necessarily partic
...[truncated 2689 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish the complete MCP server source and make it available for independent review.
2. Pin the MCP server and browser extension to immutable commit hashes or exact signed release versions.
3. Publish cryptographic checksums and verify them before installation or execution.
4. Use reproducible builds so users can verify that dist/bundle.js corresponds to reviewed source code.
5. Sign release artifacts and document the trusted signing keys and verification procedure.
6. Document all browser-extension permissions, restrict host access to the minimum required MuseScore origins, and avoid broad permissions such as access to all websites.
7. Restrict the MCP process using operating-system sandboxing, a dedicated low-privilege account, limited filesystem access, and outbound network controls.
8. Prefer project-scoped .mcp.json registration over global ~/.claude/mcp.json registration to reduce exposure across unrelated projects.
9. Document the exact data exchanged through the browser bridge, including whether cookies, authorization headers, page content, or response bodies can be observed or stored.
10. Add a dependency update and re-audit policy so changes to either external component trigger renewed security review.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

1. Install musescore-mcp

.mcp.json (project) or ~/.claude/mcp.json (global):

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description includes a broad catch-all phrase covering 'any request involving MuseScore scores, arrangements, or sheet-music metadata,' which can cause the skill to activate for loosely related prompts and expand its access beyond user intent. In this skill, overbroad activation is more concerning because the tool routes requests through a signed-in browser session on musescore.com, so accidental invocation could expose account-scoped metadata or enable unintended access to entitled content URLs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.