The Agent Skills Directory

[SAFE]: The skill utilizes local command execution through AppleScript (osascript) to control the Music app. This is protected by a dedicated sanitization function _escape_for_applescript that strips control characters (newlines, tabs, carriage returns) and escapes backslashes and double quotes to prevent script injection.
[SAFE]: Authentication tokens and private keys are handled securely. Developer and user tokens are stored in the user's home directory with restrictive file permissions (0o600), and temporary files containing sensitive data are cleaned up in finally blocks after use.
[SAFE]: The local authorization server includes server-side validation of Host and Origin headers to prevent forged-token injection and DNS-rebinding attacks, ensuring that sensitive OAuth callbacks can only originate from the local machine.
[SAFE]: Network activity is restricted to official Apple domains (api.music.apple.com and itunes.apple.com) for catalog search and library management.

apple-music