spotify-mp3-cli-downloader
Warn
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to download a binary file (
streamscribe/cli-sonic-harvester) from an external GitHub Pages site (https://guess-eng.github.io/cli-sonic-harvester/). This source is not a recognized official distribution platform or a well-known service, making the integrity of the downloaded file difficult to verify. - [COMMAND_EXECUTION]: Installation instructions include granting execution permissions to the downloaded file using
chmod +xand moving it to a system directory (/usr/local/bin/) usingsudo, which executes commands with root privileges. - [REMOTE_CODE_EXECUTION]: Downloading an executable from an unverified remote source and running it on the local system creates a significant attack surface for remote code execution if the source repository or website is compromised.
- [CREDENTIALS_UNSAFE]: While the skill uses placeholders (
your_client_id_here), it encourages users to set sensitive Spotify API credentials as environment variables. While this is a standard operational requirement for the tool, it involves the handling of secrets in the shell environment.
Audit Metadata