Security audit
Security checks across malware telemetry and agentic risk
This skill is a narrowly scoped Spotify-on-Linux controller, but users should expect it to launch Spotify, change playback, and leave the Spotify app running.
Install this only on a Linux desktop where you want OpenClaw to control Spotify. Be aware that playing a URI starts audio immediately, volume can be changed, and Spotify may remain running after the agent task ends; close Spotify manually if you do not want it to persist.
# 1. Discover Xauthority path XAUTHORITY=$(ps aux | grep -E 'Xwayland|Xorg' | grep -oP '\-auth \S+' | head -1 | cut -d' ' -f2) # 2. Launch with setsid (fully detached, survives agent restarts) DISPLAY=:0 XAUTHORITY="$XAUTHORITY" setsid -f spotify >/dev/null 2>&1 # 3. Wait for DBus registration (Spotify needs ~5-8 seconds)
XAUTHORITY=$(ps aux | grep -E 'Xwayland|Xorg' | grep -oP '\-auth \S+' | head -1 | cut -d' ' -f2) # 2. Launch with setsid (fully detached, survives agent restarts) DISPLAY=:0 XAUTHORITY="$XAUTHORITY" setsid -f spotify >/dev/null 2>&1 # 3. Wait for DBus registration (Spotify needs ~5-8 seconds) for i in $(seq 1 10); do
done ``` Key: `setsid -f` puts Spotify in its own session, independent of the launching process tree. Without it, `nohup &` still binds the process to the same session and it dies when the parent session terminates. ## 2. Search and Play a Track
done ``` Key: `setsid -f` puts Spotify in its own session, independent of the launching process tree. Without it, `nohup &` still binds the process to the same session and it dies when the parent session terminates. ## 2. Search and Play a Track
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
