sonos

• Analyzed: May 12, 2026, 3:17 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5cb07c2d91e2d04d01b191c46b36d8303d8f6a43ccfc7b0fa98fa3fc31f217fb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as benign. The `SKILL.md` file clearly defines the purpose of controlling Sonos speakers and uses a standard `go install` command to fetch and compile the `sonoscli` tool from a public GitHub repository (`github.com/steipete/sonoscli`). While this involves fetching remote code, it is a common and transparent installation method for Go applications, not indicative of malicious intent within the skill bundle itself. The mention of `SPOTIFY_CLIENT_ID/SECRET` is for an optional feature of the `sonoscli` tool, explicitly documented as a requirement for that specific functionality, and not for unauthorized credential exfiltration. There is no evidence of prompt injection attempts against the agent, obfuscation, or other malicious behaviors.