Security audit

Spotify Openclaw

Security checks across malware telemetry and agentic risk

Overview

This looks like a real Spotify control skill, but it asks for broader Spotify account access than its documented features clearly need and can make persistent account changes without confirmation.

Install only if you are comfortable giving the agent broad Spotify account access, including reading listening history and modifying playback and playlists. Review the Spotify OAuth consent screen carefully, keep the cached token private, and prefer removing unused scopes such as user-read-email and user-library-modify before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to execute shell commands and access locally stored credentials, yet it does not declare any permissions for shell or environment access. This creates a transparency and policy-enforcement gap: users and the platform may not realize the skill can launch processes, read secrets from Keychain-backed flows, and invoke local scripts that affect Spotify state.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The requested OAuth scopes include `user-read-email` and `user-read-private`, but the skill's advertised features focus on playback and music analytics, not email or profile handling. Overbroad scopes increase the blast radius of token compromise and violate least-privilege expectations for users granting access.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The skill includes logic to launch a local application automatically when no Spotify device is active. While not obviously malicious, this exceeds pure API interaction and gives the skill the ability to trigger local system actions, which is more sensitive in an agent context.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list includes broad natural-language phrases like 'play', 'pause', 'next', and 'volume' that commonly appear in ordinary conversation. In an agent environment, this raises the chance of accidental invocation, causing unintended playback changes or playlist-modifying actions without clear user intent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill description advertises playlist creation and filling behavior but does not prominently warn users that commands can create or modify Spotify playlists. Hidden write-side effects are risky because a user may expect informational assistance while the agent performs persistent account changes.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill prominently offers analysis of top tracks, artists, genres, recents, and liked songs, but it does not clearly disclose that it accesses and analyzes personal listening history and library data. This is a privacy risk because users may not understand the scope of data processed or surfaced through the agent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.