spotify-player

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the spogo and spotify_player command-line tools to interact with the Spotify service for music playback and search functionality.
  • [EXTERNAL_DOWNLOADS]: The skill metadata defines installation procedures for third-party binaries using the Homebrew package manager, specifically targeting the spogo formula from steipete/tap and the standard spotify_player formula.
  • [DATA_EXFILTRATION]: The skill facilitates authentication by importing browser cookies using the spogo auth import command. While this involves accessing sensitive session data, it is a documented requirement for the tool's operation.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external track metadata and search results from Spotify.
  • Ingestion points: Track titles, artist names, and album data returned by Spotify search commands in SKILL.md.
  • Boundary markers: None identified in the provided instructions.
  • Capability inventory: Shell command execution via CLI tools.
  • Sanitization: No explicit sanitization of search result data before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 05:35 PM
Security Audit — agent-trust-hub — spotify-player