Claude Code, Skill
Text To Sc
Give your agent SuperCollider superpowers. Five skills teach it the language, SynthDefs and live coding; a local engine boots the audio server, compiles and loads patches, and plays and rewrites them while they sound — in DSH today, and in any MCP-capable agent through the s
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
legacy/mcp_py/sc_process.py, line 331
out = subprocess.check_output(["where", binary], text=True, stderr=subprocess.DEVNULL) - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
plugin/lib/client.js, line 72
const answer = await fetch(path, { credentials: '
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
legacy/mcp_py/sc_process.py, line 331
out = subprocess.check_output(["where", binary], text=True, stderr=subprocess.DEVNULL)
legacy/mcp_py/sc_process.py, line 403
proc = subprocess.run([path, "-v"], capture_output=True, text=True, timeout=10)
legacy/mcp_py/sc_process.py, line 410
proc = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
Show more
legacy/mcp_py/sc_process.py, line 464
shutil.rmtree(workdir, ignore_errors=True)
legacy/mcp_py/sc_process.py, line 574
proc = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
legacy/mcp_py/sc_process.py, line 1306
shutil.rmtree(workdir, ignore_errors=True)
legacy/mcp_py/sc_process.py, line 1359
shutil.rmtree(workdir, ignore_errors=True)
legacy/mcp_py/sc_process.py, line 1432
child = subprocess.Popen(
legacy/mcp_py/sc_process.py, line 1544
child = subprocess.Popen([str(exe)], cwd=str(Path(install.base_dir)))
legacy/mcp_py/sc_process.py, line 1916
child = subprocess.Popen([str(exe), "-u", str(port)], stdout=log_file, stderr=log_file)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
plugin/lib/client.js, line 72
const answer = await fetch(path, { credentials: '
plugin/lib/index.js, line 350
async fetch(request) {
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit bc88a471f4e9. can delete files. can reach a host that is not written as a fixed address.
Date and source
Date checked:
github.com
Commit graded: bc88a471f4e9ff2aedf1bf62f829238c0fddfffb
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.