Spotify

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:04 PM UTC
• Version: 2.0.1

Overview

This Spotify skill is purpose-aligned, but it directs the agent to always run an unbundled local script outside the reviewed package while using Spotify account credentials and account-changing commands.

Review or provide the exact `~/.openclaw/scripts/spotify.py` yourself before using this skill. Install only if you are comfortable giving it Spotify account access, storing Spotify app credentials in macOS Keychain, and letting agent-triggered commands control playback and create or modify playlists. Prefer explicit Spotify requests and confirm account-changing actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:25
• Finding: Forced Execution of an Unbundled and Unverified Local Script## Vulnerability Details **File Location**: `SKILL.md`, line 25 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown > **ALWAYS run `python3 ~/.openclaw/scripts/spotify.py [cmd]`** — never respond with text only. ``` ### Technical Analysis The skill unconditionally instructs the agent to execute `~/.openclaw/scripts/spotify.py` and explicitly prohibits a text-only response. The referenced script is outside the project directory and is not included in the audited artifact. Its contents, provenance, permissions, and integrity therefore cannot be verified from this project. Because the path is mutable and external to the reviewed package, the behavior described by the skill is not necessarily the behavior that will execute. Any process or user capable of creating or replacing that file can control the Python code subsequently run by the agent. The unconditional wording also attempts to direct agent behavior whenever the skill is invoked, without requiring validation of the executable or confirmation from the user. ### Attack Path 1. An attacker or compromised local process creates or replaces `~/.openclaw/scripts/spotify.py`. 2. The replacement script contains attacker-controlled Python code. 3. The user makes a request matching one of the skill's Spotify-related triggers. 4. The skill instructs the agent to execute the external script and not provide a text-only response. 5. The attacker-controlled code runs with the same operating-system privileges and environment access as the agent process. 6. The script can access resources available to that account, potentially including files, network services, and Spotify credentials retrieved from macOS Keychain. ### Impact Assessment Successful exploitation permits arbitrary Python execution under the privileges of the account running the agent. The resulting scope may include reading or modifying user-access ...[truncated 419 chars]
• Remediation: ## Remediation Suggestions 1. Include the Spotify implementation within the audited project rather than referencing a mutable file in the user's home directory. 2. Resolve the executable through a package-relative canonical path and reject paths that escape the installed skill directory. 3. Verify the script against a signed release or an approved cryptographic hash before execution. 4. Remove the unconditional `ALWAYS` and `never respond with text only` directives. 5. Require explicit user confirmation before executing a script whose provenance or integrity cannot be established. 6. Execute the implementation with least privilege and restrict filesystem, Keychain, subprocess, and network access to what Spotify control strictly requires. 7. Document the exact credential access and outbound network behavior so they can be audited.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Python Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 14–21 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml "install": [ { "id": "pip", "kind": "pip", "package": "spotipy", "label": "Install spotipy (pip)", }, ], ``` ### Technical Analysis The installation metadata requests `spotipy` without an exact version, lockfile, or cryptographic integrity hash. Dependency resolution can therefore select a different package release over time, making the installed code non-reproducible and allowing its behavior to change after the skill has been reviewed. No evidence establishes that the named package is currently malicious. The vulnerability is the absence of controls that bind installation to a reviewed artifact. If the upstream package, package index, release process, or dependency chain is compromised, an affected release could execute code during installation or when imported by the Spotify implementation. ### Attack Path 1. An attacker compromises an upstream release, distribution account, package-index path, or transitive dependency associated with the unpinned package. 2. A malicious or otherwise unsafe package version becomes the version selected by `pip`. 3. The skill installation process resolves `spotipy` without enforcing a reviewed version or hash. 4. The compromised package is installed. 5. Malicious code executes during installation or when the package is imported and used. ### Impact Assessment Exploitation can result in code execution with the privileges of the user or process performing installation or running the skill. This may expose user-accessible files, environment data, network access, and credentials available to the process. The precise impact depends on the installation environment and the behavior of the compromised package. The audited file does not request elevated install ...[truncated 100 chars]
• Remediation: ## Remediation Suggestions 1. Pin `spotipy` to an exact, reviewed version. 2. Use a lockfile that records all transitive dependencies and their exact versions. 3. Require cryptographic hashes for every downloaded distribution, such as through a hash-locked requirements file and `pip --require-hashes`. 4. Prefer a controlled or explicitly trusted package index and disable unexpected fallback indexes. 5. Review package provenance, release signatures where available, maintainership changes, and known vulnerabilities before updating the lockfile. 6. Install dependencies into an isolated virtual environment with least privilege. 7. Perform dependency updates through a controlled review and testing process rather than automatically accepting the latest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The metadata description advertises very broad trigger phrases such as 'pause', 'playlist', 'genres', and 'open spotify', which are likely to collide with ordinary conversation and unrelated user requests. In an agent environment, broad activation can cause unintended execution of playback or account-modifying commands, especially because the skill also instructs the agent to always run a command rather than respond conversationally.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The instruction says to ALWAYS run a specific English command invocation and never respond with text only, while elsewhere the skill claims multi-language triggers. This creates a language/locale constraint without user choice or clear opt-in, which may violate organizational language policy expectations.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup (first time)

1. Create app at [developer.spotify.com/dashboard](https://developer.spotify.com/dashboard)
   — Add redirect URI: `http://127.0.0.1:8888/callback`

2. Add to macOS Keychain:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Top tracks of any artist
python3 ~/.openclaw/scripts/spotify.py artist-top-tracks "Massive Attack" 5

# Create playlist from top tracks (one command: creates + fills)
python3 ~/.openclaw/scripts/spotify.py make-playlist "Top March 2026" short 20

# Manage playlists

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.