Music Identify

This skill appears to do what it says, but before installing consider: - It stores secrets as files: AudD API key (~/.config/audd/api_key) and Spotify credentials/tokens (~/.config/spotify/). Make sure those files are created with restrictive permissions (chmod 600) and store only credentials you trust. - The Spotify auth script runs a temporary HTTP server bound to 0.0.0.0:8888 to receive the OAuth callback. If you expose that port via a public tunnel (ngrok, Tailscale Serve, etc.), anyone who can reach it could attempt to hit the callback; prefer using a local-only redirect URI or ensure the tunnel is private. - The skill appends identifications to memory/music-log.json; this creates a persistent local history of songs you asked about. If that is sensitive, periodically rotate or delete the file or change where it is written. - AudD requests audio files to api.audd.io; check AudD's privacy/retention policy before sending audio you consider private. Also keep track of API usage limits/costs. - The scripts are plain and readable (no obfuscated code). If you have stricter security requirements, inspect the scripts yourself before running and consider running the auth flow on an isolated machine. If these behaviors are acceptable (local credential files, local log, and a temporary auth server), the skill is coherent and can be used. If you are uncomfortable with any of the above, do not install or modify the scripts to match your security posture (for example, change the redirect URI to a localhost-only address, encrypt stored tokens, or change the memory log location).