export
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the official Spotify Ads API atapi-partner.spotify.com. These operations are limited to data retrieval for the purpose of generating the CSV export. - [SAFE]: The skill follows secure credential management by instructing the agent to read tokens from local configuration files (e.g.,
.claude/spotify-ads-api.local.md) rather than hardcoding them. - [SAFE]: Data processing and CSV generation use Python's standard
csvlibrary, which correctly handles escaping and prevents common injection issues in generated files. - [SAFE]: All external communications are directed to the official vendor domain (
spotify.com) and include vendor-specific tracking headers (X-Spotify-Ads-Sdk), consistent with legitimate API usage.
Audit Metadata