spotify-player
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
spogoandspotify_playercommand-line tools to interact with the Spotify service for music playback and search functionality. - [EXTERNAL_DOWNLOADS]: The skill metadata defines installation procedures for third-party binaries using the Homebrew package manager, specifically targeting the
spogoformula fromsteipete/tapand the standardspotify_playerformula. - [DATA_EXFILTRATION]: The skill facilitates authentication by importing browser cookies using the
spogo auth importcommand. While this involves accessing sensitive session data, it is a documented requirement for the tool's operation. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external track metadata and search results from Spotify.
- Ingestion points: Track titles, artist names, and album data returned by Spotify search commands in
SKILL.md. - Boundary markers: None identified in the provided instructions.
- Capability inventory: Shell command execution via CLI tools.
- Sanitization: No explicit sanitization of search result data before processing.
Audit Metadata