ableton-live-mcp-control

SUSPICIOUS: The skill's DAW-control capabilities mostly match its purpose, but it delegates setup to a separately owned GitHub repo, uses a mutable clone+pip install path that differs from the project's documented package flow, and exposes powerful arbitrary Python execution inside Ableton. No credential harvesting or off-platform exfiltration is evident, so this is not malicious, but it carries meaningful supply-chain and execution risk.