spotify

Purpose and capabilities are mostly aligned to Spotify account management, and `save-to-spotify` has strong same-org legitimacy. The main issue is that the skill requires an unverified `spotify-api` binary from PATH and entrusts it with Spotify auth and account actions, which makes this a high supply-chain/credential-forwarding risk despite no clear signs of malware or unrelated data exfiltration.