Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pantani/ableton-mind/security-auditnpx skills add Pantani/ableton-mind --skill security-auditgit clone --depth 1 https://github.com/Pantani/ableton-mindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pantani/ableton-mind/security-audit)<a href="https://agentmods.dev/skills/pantani/ableton-mind/security-audit"><img src="https://agentmods.dev/badge/skills/pantani/ableton-mind/security-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.00288 |
| Opus 5 | $0.00023 | $0.00144 |
| Sonnet 5 | $0.00009 | $0.00058 |
| Haiku 4.5 | $0.00005 | $0.00029 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security Audit
Use this skill for practical security review of ableton-mind.
Workflow
- Inspect package scripts before executing them.
- Run dependency audit when available:
npm audit --omit=dev. - Search for risky surfaces: child processes, eval-like execution, filesystem writes, network listeners, path joins, environment variables and secret use.
- Review JSON-RPC bridge input validation, handler dispatch, error handling, localhost exposure and listener notifications.
- Review GitHub Actions permissions, token use, release provenance and Docker publishing.
- Rank issues by exploitability and affected user.
Finding Requirements
Each finding must include:
- Severity.
- File and line when possible.
- Attack or misuse path.
- Why this matters for a local MCP/Remote Script project.
- Suggested fix.
- Verification command or review step.
Report Format
Write _workspace/quality-audit/security-{N}.md with findings that include all required fields from the "Finding Requirements" section above.
Non-Goals
Do not report generic "dependency exists" noise without an affected path. Do not run external write or publish actions while auditing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 36 lines · 47 tokens per session scan A 8a5e4c4d5b1b
security-audit is a skill published in the GitHub repository Pantani/ableton-mind (5 stars, last pushed 2mo ago), licensed MIT. It adds 47 tokens to every session and 288 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ableton-live
Connect and operate the Loophole Bridge (Ableton Live MCP server). Use when the user wants to check Live/bridge prerequisites, wire an MCP client to Loophole, or run a Live editing recipe (humanize, build arrangement, batch rename, chord from prompt). Triggers: "is my Ableton bridge working", "set up loophole"…
groove-builder
Use when the user wants drum patterns by genre - kick, snare, hi-hat, percussion. Examples - "give me a trap beat", "house drum pattern", "DnB drums at 174", "lo-fi drums with swing", "boom-bap pattern".
mastering-prep
Use when the user is finishing a track and wants to check it's ready to send to a mastering engineer or for self-mastering. Audits headroom, peak levels, mono compatibility, frequency balance, LUFS. Examples - "is this ready to master?", "audit my mix before export", "check my levels".
midi-cleanup
Use when the user asks to humanize a MIDI part, fix voice leading, quantize notes, clean up timing, fix stuck/duplicate notes, or generally polish a MIDI clip they recorded or wrote. Examples - "humanize this hat", "voice these chords better", "the timing is too stiff", "fix the voice leading on the strings".
mixer-doctor
Use when the user describes a mix problem ("muddy", "harsh", "no headroom", "vocals get lost", "kick and bass fighting") or asks for a mix audit. Diagnoses the issue from session state and proposes specific corrective moves with EQ, compression, sends, and routing.
producer-mode
Use when the user asks to set up tracks, pick instruments, scaffold an arrangement, build a project template, or describe a track they want to make in Ableton Live. Examples - "make me a 4-bar lo-fi loop", "set up a film score template", "I want to start a hip-hop beat in C minor".