spotify-skill
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with official Spotify domains (
api.spotify.com,accounts.spotify.com) and utilizes the standard OAuth 2.0 PKCE flow for secure authentication. - [SAFE]: Sensitive credentials (authentication tokens) are stored locally in the skill's directory with restrictive file permissions (
0o600), preventing unauthorized access by other users on the system. - [SAFE]: The implementation relies entirely on the Python standard library, avoiding supply chain risks associated with third-party dependencies or external package registries.
- [SAFE]: The skill provides clear documentation regarding the risks and tradeoffs of using session tokens, and explicitly avoids requesting write-access scopes to ensure a read-only footprint.
- [SAFE]: CSV processing and data normalization logic are contained within standard parsers and do not involve unsafe interpolation into shell commands or prompts.
Audit Metadata