Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only FL Studio scripting reference; it can guide project-changing actions, but those capabilities fit its stated purpose and are not hidden or automatic.
Install with ordinary caution for a DAW automation reference: ask the agent to inspect projects read-only by default, make backups before editing .flp files, save modified projects under a new name, and confirm before running scripts that arm recording, change mixer state, delete notes, or alter undo history.
The skill explicitly advertises save-file manipulation and FLP project reading/writing but does not warn users about the risk of overwriting, corrupting, or otherwise altering project data. In a DAW context, project files are valuable user assets, so omission of safety guidance can lead an agent to perform destructive file operations without backups or confirmation.
The PyFLP section describes reading and writing .flp files without cautioning that writes may be destructive, irreversible, or incompatible with some projects/workflows. Because this skill is intended to enable automation over project files, the lack of guardrails increases the chance of silent data loss or unintended project modification.
This markdown reference describes actions like arming a track for recording and other state-changing controls, but provides no user warning that invoking these APIs changes the active project and may affect recording behavior. For markdown files, omissions of warnings about behaviors affecting user data or system integrity should be flagged when destructive or consequential actions are documented without disclosure.
Line L134 says the function toggles selection and begins to describe a deselected track changing state, but the sentence is cut off before stating the actual resulting behavior. Because this is API reference documentation for a mutating function, the truncated text can misstate or obscure the function's real effect for users relying on the reference.
Line L154 starts by saying the function toggles mute state, then cuts off after 'An unmuted track will become', leaving the documented effect incomplete. For an API that changes playlist state, this creates intent-code divergence because the reference fails to fully communicate the mutation the function performs.
Line L170 begins to describe toggling solo state but ends at 'An unsolo track will become', omitting the completed outcome. This leaves the intended behavior of a state-changing API undocumented in a way that can conflict with the function's actual operation.
This markdown file includes an example that modifies a project and saves changes to disk, which can affect user data. The description does not include any warning or caution about editing project files, potential overwrites, or recommending backups before saving.
No suspicious patterns detected.
