cli-anything-musescore
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a command-line interface for MuseScore 4 to perform tasks like transposition, part extraction, and file conversion. No suspicious network activities, credential access, or privilege escalation commands were found.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external music files which could contain malicious data.
- Ingestion points: Files with extensions .mscz, .mxl, .musicxml, and .mid are read via the -i parameter in commands such as transpose, export, and parts in SKILL.md.
- Boundary markers: The agent guidance suggests using the --json flag for machine-readable output, which helps isolate tool output.
- Capability inventory: The skill is limited to file system read/write operations associated with MuseScore; it lacks network access or general shell execution.
- Sanitization: Processing depends on MuseScore 4's standard file parsing mechanisms.
Audit Metadata