Clawtunes Play

• Analyzed: Apr 5, 2026, 10:41 PM
• Findings: 1
• Version: 1.0.3
• Hash: b2e55e2015c1b250ee95fb8a3fd39ccf0a60f32d024994939b202275b296acd3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill utilizes high-risk capabilities including UI automation via `osascript` and `System Events` to inject keystrokes (e.g., Tab, Enter, Cmd+L) into the macOS Music app, which requires Accessibility permissions. It also performs network requests to the iTunes API (`itunes.apple.com`) and executes shell commands via `subprocess` to interact with the `clawtunes` CLI. While these actions are aligned with the stated purpose of automating Apple Music playback and catalog navigation, the use of keystroke simulation and shell execution represents a significant privilege level and attack surface. Key files: `catalog_play.py`, `playlist_create.py`, and `SKILL.md`.