Spotify Openclaw

Full Spotify Premium control + deep music intelligence for OpenClaw. Playback: play by name/URI/playlist, pause, next, prev, volume, shuffle, queue. Auto-lau...

Security Scan

The skill's code, runtime instructions, and requested access are consistent with a macOS Spotify helper that uses spotipy and the Keychain to manage Spotify OAuth — nothing in the package appears disproportionate to its stated purpose.

Purpose & Capability

Name/description (Spotify playback, analysis, discovery) match the included python script and SKILL.md. The script uses spotipy and Spotify APIs, reads client credentials from macOS Keychain, and stores a local token cache — all expected for this functionality.

Instruction Scope

SKILL.md tells the user/agent to copy the script to ~/.openclaw/scripts and run python3 commands; the script itself runs the macOS 'security' command to read Keychain, performs OAuth (opens browser), calls Spotify APIs, and writes a cache at ~/.openclaw/.spotify_cache. These actions are within the described scope but are macOS-specific and involve storing OAuth tokens locally.

Install Mechanism

The registry shows no install spec (instruction-only), but SKILL.md includes a pip install recommendation for the 'spotipy' package. Installing spotipy from PyPI is a reasonable, low-to-moderate-risk choice for this skill; there is no opaque remote download or archive extraction.

Credentials

No unrelated environment variables or external credentials are requested. The skill instructs the user to place Spotify client_id/secret into macOS Keychain and then reads them via the 'security' tool; that is proportional to performing OAuth with Spotify. The script requests broad Spotify scopes (playback, library, playlists) that are necessary for the advertised features.

Persistence & Privilege

The skill is not always-enabled, is user-invocable, and does not request unusual persistent privileges. It writes a token cache under ~/.openclaw/.spotify_cache and is meant to be copied into the user's OpenClaw scripts folder — expected behavior for a local helper.

Assessment

This skill appears to do exactly what it claims: control Spotify playback and analyze your library. Before installing, verify the GitHub source you trust, install the 'spotipy' package from PyPI, and only add your Spotify client_id/client_secret to the macOS Keychain if you trust the script. Be aware: OAuth tokens and cache are stored locally at ~/.openclaw/.spotify_cache; you can revoke app access from your Spotify Developer Dashboard if needed. Note this is macOS-specific (uses the 'security' Keychain tool) and requires Spotify Premium for playback control. If you want extra assurance, skim spotify.py for any external URLs or unexpected subprocess calls (the script uses 'security' and standard Spotify API calls, which is normal).

Full Spotify Premium control + music intelligence for OpenClaw.

Control playback, analyze your taste, and discover new music — all from chat. 100% local, no extra cloud services.

✨ What makes this different

Feature	This skill	Basic Spotify skills
Playback control	✅ play/pause/next/prev/volume/shuffle/queue	✅
Auto-launch Spotify	✅ opens app if closed, waits, plays	❌
Taste analysis	✅ top tracks & artists × 3 time periods	❌
Genre profile	✅ full genre breakdown	❌
Music discovery	✅ works without blocked Recommendations API	❌
Liked songs search	✅ filter by artist, count, stats	❌
One-command playlists	✅ creates + fills in one command	❌
Multi-language	✅ English + Russian voice triggers	❌

📦 Requirements

• macOS with Spotify Premium
• Free Spotify Developer app — developer.spotify.com/dashboard
• Python 3 + spotipy (pip install spotipy)

⚙️ Setup (one-time)

1. Create Spotify app at developer.spotify.com → add redirect URI: http://127.0.0.1:8888/callback

2. Store credentials in macOS Keychain:

security add-generic-password -a openclaw -s openclaw.spotify.client_id -w "YOUR_CLIENT_ID"
security add-generic-password -a openclaw -s openclaw.spotify.client_secret -w "YOUR_CLIENT_SECRET"

3. Copy script to OpenClaw scripts folder:

cp spotify.py ~/.openclaw/scripts/spotify.py

4. First auth (browser opens once, then token is cached):

python3 ~/.openclaw/scripts/spotify.py now

⚡ Quick start

# Play something
python3 ~/.openclaw/scripts/spotify.py play "Massive Attack"

# What's playing now
python3 ~/.openclaw/scripts/spotify.py now

# Discover new music based on your taste
python3 ~/.openclaw/scripts/spotify.py discover

# Build this month's playlist (creates + fills in one command)
python3 ~/.openclaw/scripts/spotify.py make-playlist "Top March 2026" short 20

🎮 All Commands

Playback

python3 ~/.openclaw/scripts/spotify.py play                    # resume
python3 ~/.openclaw/scripts/spotify.py play "track name"       # search & play
python3 ~/.openclaw/scripts/spotify.py play spotify:track:URI  # by URI
python3 ~/.openclaw/scripts/spotify.py pause
python3 ~/.openclaw/scripts/spotify.py next
python3 ~/.openclaw/scripts/spotify.py prev
python3 ~/.openclaw/scripts/spotify.py volume 70
python3 ~/.openclaw/scripts/spotify.py volume up / down
python3 ~/.openclaw/scripts/spotify.py shuffle on / off
python3 ~/.openclaw/scripts/spotify.py queue "track name"
python3 ~/.openclaw/scripts/spotify.py now
python3 ~/.openclaw/scripts/spotify.py devices

Analysis

python3 ~/.openclaw/scripts/spotify.py top-tracks [short|medium|long] [limit]
python3 ~/.openclaw/scripts/spotify.py top-artists [short|medium|long] [limit]
python3 ~/.openclaw/scripts/spotify.py genres [short|medium|long]
python3 ~/.openclaw/scripts/spotify.py recent [limit]
python3 ~/.openclaw/scripts/spotify.py liked [limit]
python3 ~/.openclaw/scripts/spotify.py liked-all
python3 ~/.openclaw/scripts/spotify.py liked-by-artist "Artist Name"
python3 ~/.openclaw/scripts/spotify.py playlists
python3 ~/.openclaw/scripts/spotify.py search "query" [track|artist|album] [limit]
python3 ~/.openclaw/scripts/spotify.py track-info URI

Periods: short = 4 weeks · medium = 6 months · long = all time

Discovery & Playlists

# Discover by genre profile
python3 ~/.openclaw/scripts/spotify.py discover

# Expand from artist (depth=hops, n=tracks per artist)
python3 ~/.openclaw/scripts/spotify.py discover "Portishead" 3 3

# Related artists
python3 ~/.openclaw/scripts/spotify.py related-artists "The Cure" 10

# Top tracks of any artist
python3 ~/.openclaw/scripts/spotify.py artist-top-tracks "Massive Attack" 5

# Create playlist from top tracks — one command, creates + fills
python3 ~/.openclaw/scripts/spotify.py make-playlist "Top March 2026" short 20

# Manage playlists
python3 ~/.openclaw/scripts/spotify.py create-playlist "My Playlist" "Description"
python3 ~/.openclaw/scripts/spotify.py add-to-playlist PLAYLIST_ID URI1 URI2

Note: Spotify's recommendations and audio_features APIs are blocked for new developer apps. This skill uses related_artists + artist_top_tracks for discovery instead — no workarounds needed.

💡 Agent tips

• Chain related-artists → artist-top-tracks → add-to-playlist for smart discovery playlists
• Use liked-by-artist to build themed playlists from your library
• genres long gives the most accurate taste profile
• Use playlists to get playlist IDs before playing one

ALWAYS run python3 ~/.openclaw/scripts/spotify.py [cmd] — never respond with text only.