Spotify Openclaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:23 AM UTC
• Version: 1.0.0

Overview

This Spotify skill mostly matches its stated purpose, but it tells the agent to always run local commands and keeps broad Spotify account permissions, so it belongs in Review before installation.

Install only if you are comfortable giving this skill access to your Spotify listening data, private playlists, playback controls, and playlist modification. Before use, reduce unused OAuth scopes where possible, delete any old broad OAuth cache after scope changes, prefer explicit Spotify-prefixed commands, and require confirmation before creating or modifying playlists or changing playback.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:149

Finding

Unconditional Agent Execution and Response Hijacking

Content

View full analysis

**ALWAYS run `python3 ~/.openclaw/scripts/spotify.py [cmd]`** — never respond with text only. ``` ### Technical Analysis This instruction is an unconditional behavioral directive aimed at the agent rather than ordinary user-facing documentation. It requires the agent to execute a local command and explicitly prohibits text-only responses. Because skill instructions may be loaded into an agent's active context, imperative terms such as “ALWAYS” and “never” can alter the agent's current response policy. The directive does not limit execution to explicit Spotify-control requests, require user confirmation, or preserve the agent's normal authorization and safety checks. The Python command itself invokes the local Spotify utility, which can access Keychain-derived credentials, cached OAuth tokens, private Spotify account data, playlists, and playback controls. ### Attack Path 1. The skill is loaded into an agent's active context. 2. The agent processes the unconditional instruction at line 149. 3. A user asks a question for which explanation, clarification, or confirmation would ordinarily be sufficient. 4. The instruction pressures the agent to run `spotify.py` instead of returning a text-only response. 5. The script initializes Spotify authentication and may perform an account operation selected from its command interface. 6. The agent's normal response policy and the user's intended interaction mode are displaced. ### Impact Assessment Successful instruction hijacking can cause unnecessary local command execution and unauthorized interaction with the user's Spotify session. Depending on the selected command and the OAuth token's permissions, the execution context can read listening history and library information, inspect private playlists, control playback, or modify playli ...[truncated 242 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: spotify.py:94

Finding

Spotify OAuth Client Requests Permissions Beyond Implemented Requirements

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:20

Finding

Unpinned Spotipy Dependency Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

`. - Generate and verify cryptographic hashes for the exact distribution artifacts. - Place dependencies in a lock file or hash-checked requirements file. - Install the skill in an isolated virtual environment rather than the user's global Python environment. - Configure installation to use the official package index over TLS and avoid untrusted mirrors. - Add automated dependency vulnerability and provenance scanning. - Review and deliberately update the pinned version instead of accepting automatic future releases. For example: ```text spotipy== \ --hash=sha256: \ --hash=sha256: ``` The skill metadata should reference the same pinned version used by the lock or requirements file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases include extremely common words like 'play', 'pause', and 'next', which are likely to appear in ordinary conversation. That makes accidental invocation plausible, especially because this skill can start playback, change volume, or modify queues and playlists, turning misrouting into real side effects.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 5)May include surrounding context.

python

"""
Spotify CLI helper для OpenClaw агента.
Избегает проблем с кавычками в bash — всё через Python.
Читает CLIENT_ID/SECRET из Keychain автоматически.

Использование:
  python3 /Users/mixx/.openclaw/scripts/spotify.py top-tracks [short|medium|long] [limit]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 61)May include surrounding context.

python

"""
Spotify CLI helper для OpenClaw агента.
Избегает проблем с кавычками в bash — всё через Python.
Читает CLIENT_ID/SECRET из Keychain автоматически.

Использование:
  python3 /Users/mixx/.openclaw/scripts/spotify.py top-tracks [short|medium|long] [limit]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 72)May include surrounding context.

python

"""
Spotify CLI helper для OpenClaw агента.
Избегает проблем с кавычками в bash — всё через Python.
Читает CLIENT_ID/SECRET из Keychain автоматически.

Использование:
  python3 /Users/mixx/.openclaw/scripts/spotify.py top-tracks [short|medium|long] [limit]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 60)May include surrounding context.

python

return _ME_CACHE["id"]


def _keychain_get(service):
    """Читает значение из macOS Keychain."""
    result = subprocess.run(
        ["security", "find-generic-password", "-a", "openclaw", "-s", service, "-w"],

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 74)May include surrounding context.

python

return _ME_CACHE["id"]


def _keychain_get(service):
    """Читает значение из macOS Keychain."""
    result = subprocess.run(
        ["security", "find-generic-password", "-a", "openclaw", "-s", service, "-w"],

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · spotify.py (reported line 78)May include surrounding context.

python

return _ME_CACHE["id"]


def _keychain_get(service):
    """Читает значение из macOS Keychain."""
    result = subprocess.run(
        ["security", "find-generic-password", "-a", "openclaw", "-s", service, "-w"],

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · spotify.py (reported line 567)May include surrounding context.

python

return devices[0]["id"]
    # Нет устройства — запускаем Spotify
    print("⚡ Spotify не запущен — открываю...")
    os.system("open -a Spotify")
    for i in range(retries):
        time.sleep(wait)
        devices = sp.devices().get("devices", [])

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises shell-based setup and runtime commands but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing tool declarations can let the skill invoke shell or environment access without clear user awareness or enforcement, increasing the chance of unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description emphasizes convenience but does not clearly warn that the skill can automatically launch Spotify, control playback, and create or modify playlists. Users may invoke it without understanding that commands have external side effects on their Spotify account and current listening session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

⚙️ Setup (one-time)

1. Create Spotify app at developer.spotify.com → add redirect URI: http://127.0.0.1:8888/callback

2. Store credentials in macOS Keychain:

bash

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

# Top tracks of any artist
python3 ~/.openclaw/scripts/spotify.py artist-top-tracks "Massive Attack" 5

# Create playlist from top tracks — one command, creates + fills
python3 ~/.openclaw/scripts/spotify.py make-playlist "Top March 2026" short 20

# Manage playlists

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file’s user-facing natural language is consistently Russian in the module description and command help, with no indication that other languages are supported or that the user can choose a locale. This can violate a language/locale policy when a skill imposes a specific language without explicit opt-in or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · spotify.py (reported line 62)May include surrounding context.

python

def _keychain_get(service):
    """Читает значение из macOS Keychain."""
    result = subprocess.run(
        ["security", "find-generic-password", "-a", "openclaw", "-s", service, "-w"],
        capture_output=True, text=True
    )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes Spotify playback/control and music analysis features, but does not declare that the skill will execute local OS-level commands. In ensure_active_device, the code uses os.system("open -a Spotify") to spawn a desktop app, which is a broader host-control capability than ordinary Spotify Web API usage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest focuses on playback, music analytics, discovery, playlist building, and Keychain-backed credentials, but does not mention reading account email or general private profile data. The requested OAuth scopes include user-read-email and user-read-private, yet the implemented commands only appear to need the user ID from sp.me() for playlist creation, making the broader profile/email access inconsistent with the described behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.