Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for MuseScore access, but it understates local file-writing behavior and relies on a signed-in browser session plus external components.
Review this before installing: it depends on external MCP and browser-extension code, uses your signed-in MuseScore browser session, and may write downloaded or converted files locally. Only install it if you trust those components and are comfortable using your account session for this workflow.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
.mcp.json (project) or ~/.claude/mcp.json (global):
{
The skill is described as search/metadata access, but the documented capabilities include downloading files, writing to local output paths, and converting local SVG/SVGZ files from disk into PDFs. This mismatch can cause users or downstream agents to grant the skill broader trust than warranted, increasing the chance of unintended local file writes or processing of attacker-controlled files.
The manifest lists several concrete trigger phrases, but then expands activation to "any request involving MuseScore scores, arrangements, or sheet-music metadata." That catch-all condition is broad and lacks clear boundaries or exclusion examples, which could cause unintended invocation for ordinary music-related requests.
The Notes section claims the skill is 'Read-only', but the tools explicitly support writing PDFs to disk and converting local files. Incorrectly labeling the skill as read-only is dangerous because it can bypass user expectations and policy decisions that rely on accurate declaration of write capabilities.
No suspicious patterns detected.