Spotify Connect

• Analyzed: May 14, 2026, 4:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9239690cca0de91ef7eaa7c89af9a5f9da5578fdcac2003eea242d75ad6a2ab0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'spotify-connect' is benign. Its `SKILL.md` provides clear, functional instructions for controlling Spotify playback, including setting up API credentials and managing multiple accounts. The `scripts/spotify.py` implements this functionality using the official `spotipy` library, securely handling OAuth tokens, storing configuration in `~/.openclaw/spotify-connect/`, and accessing necessary environment variables (`SPOTIFY_CLIENT_ID`, `SPOTIFY_CLIENT_SECRET`). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's behavior beyond the stated purpose.