skills/daxaur/openpaw/c-music/Gen Agent Trust Hub

c-music

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the spogo CLI to perform actions such as play, pause, search, and volume. These commands interact with a locally installed utility to manage Spotify playback.
  • [SAFE]: No malicious patterns were detected. The skill uses standard CLI patterns for its intended purpose without obfuscation, sensitive data access, or unauthorized network communication.
  • [SAFE]: Indirect Prompt Injection analysis: The skill processes external data from Spotify (track names, playlist titles) via spogo search and spogo status. While this creates a theoretical ingestion surface, the lack of dangerous capabilities (like file writing or general shell execution) and the specific nature of the tool limit the risk to a negligible level.
  • Ingestion points: Output from spogo status, spogo search, and spogo playlist list.
  • Boundary markers: None.
  • Capability inventory: Spotify playback control via spogo CLI.
  • Sanitization: None identified in the prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 08:44 AM
Security Audit — agent-trust-hub — c-music