music-connect
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
cogmusicpackage from the official NPM registry during the registration process. - [REMOTE_CODE_EXECUTION]: The
npxcommand is used to execute thecogmusicpackage to run the MCP server. This is the primary intended function of the setup skill. - [COMMAND_EXECUTION]: The skill executes
claude mcpcommands to manage the local configuration and registration of the music production toolset. - [CREDENTIALS_UNSAFE]: The skill handles a
COGMUSIC_TOKEN. It instructs the user to generate this token via their browser and provide it as a command-line argument. It explicitly warns the user to treat the token as a secret and ensures it is stored in the local environment configuration rather than hardcoded or transmitted elsewhere.
Audit Metadata