Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Artist Research

Performs in-depth artist analysis combining Spotify API and external web data to report streaming stats, market position, and monetization potential.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 14 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (Spotify + web data artist analysis) matches the included code's intent (spotify_api_lookup.py). However SKILL.md references additional capabilities (kworb scraping, web_fetch automation, generate_report.py) that are not implemented in the provided codebase, indicating a mismatch between claimed capabilities and actual files.
!
Instruction Scope
SKILL.md instructs use of web_fetch, automated kworb.net collection, and running generate_report.py, but the repository only contains spotify_api_lookup.py and a references file. The instructions also say credentials live in '.env' while the code explicitly loads a .env from a ../../spotify-songs-to-notion path — a scope creep that may cause the agent to read credentials outside the skill directory.
Install Mechanism
No install spec is provided (instruction-only), which lowers installation risk. However SKILL.md requires Python packages (spotipy, python-dotenv) but doesn't declare that in metadata or provide a pinned install mechanism, creating an operational gap and ambiguity for users.
!
Credentials
Registry metadata lists no required env vars, but SKILL.md requires Spotify credentials (SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET, SPOTIPY_REDIRECT_URI). More concerning: spotify_api_lookup.py loads a .env file from a relative path outside the skill (../../spotify-songs-to-notion/.env) and imports spotify_auth from that sibling path — this could cause the skill to read unrelated secrets or execute code from another project. That is disproportionate and unexpected for an artist-research skill.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system settings. It writes output files only when asked (--json) and otherwise appears to be transient.
What to consider before installing
Do not run this skill with sensitive credentials or on a production machine until these issues are resolved. Specific actions to consider before installing or running: - Ask the author for the missing files (generate_report.py, web_fetch implementation) or a trimmed SKILL.md that matches the shipped code. - Inspect the spotify_auth module referenced at ../../spotify-songs-to-notion/spotify_auth.py before running; the script modifies sys.path to import it, which can execute arbitrary code from another repo. - Never place global or high-privilege secrets in a shared .env that the skill might read; prefer ephemeral API credentials or environment variables scoped to the process. - If you must test, run in an isolated sandbox or throwaway VM and use throwaway Spotify credentials with minimal scope. - Request the author to remove hard-coded relative .env loading and instead accept credentials from the declared environment variables or documented config paths within the skill directory. - Verify any web-scraping (kworb.net, Instagram) is implemented intentionally and check for external endpoints; confirm the skill does not exfiltrate data to unexpected hosts. If the author can show (1) the missing files or remove references to them, (2) change the .env loading to use only in-skill config or documented environment variables, and (3) provide the spotify_auth code for review, the incoherences could be resolved and the risk reduced.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk971h4empm3wesf31m8an1v2tx830dzc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Artist Research — Skill for OpenClaw

Comprehensive artist analysis using Spotify API (Feb 2026 Development Mode limits) + web data sources. Generates professional reports with streaming data, market positioning, and monetization potential.

When to Use

  • User asks about an artist's performance, potential, or market position
  • User requests music industry analysis or artist comparison
  • User wants streaming data, chart history, or audience demographics
  • User is evaluating signing, managing, or collaborating with an artist

Prerequisites

  • Spotify API credentials in .env (SPOTIPY_CLIENT_ID, SPOTIPY_CLIENT_SECRET, SPOTIPY_REDIRECT_URI)
  • spotipy and python-dotenv packages installed
  • Internet access for web_fetch data sources

Methodology

Step 1: Spotify API Data Collection

Run spotify_api_lookup.py with artist name or ID. Collects:

  • Artist metadata (name, images, URI, genres)
  • Discography (albums, singles, track listings)
  • Related artists (for market positioning)
  • Search results for artist tracks

NOTE: Since Feb 2026, Development Mode does NOT return:

  • followers, popularity (for artists)
  • popularity (for tracks/albums)
  • top-tracks endpoint (REMOVED)
  • bulk fetch endpoints (REMOVED)

See references/spotify-endpoints-2026.md for full list.

Step 2: External Data Sources (web_fetch)

SourceURL PatternData AvailableReliability
kworb.netkworb.net/spotify/artist/{ID}.htmlChart history, total streams, peak positions, per-track streams⭐⭐⭐⭐⭐ Best source
kworb.netkworb.net/spotify/track/{ID}.htmlIndividual track daily streams⭐⭐⭐⭐⭐
Spotify Profileopen.spotify.com/artist/{ID}Monthly listeners (visible in browser), verification status⭐⭐⭐⭐ (requires browser for ML)
GoogleGoogle search artist name + "monthly listeners"AI overview with context⭐⭐⭐
Instagraminstagram.com/{handle}Follower count, engagement⭐⭐⭐ (requires browser)

Sources that DON'T work with web_fetch (JS-heavy):

  • songstats.com (returns empty)
  • chosic.com (404)
  • chartmasters.org (404/broken)
  • tunemunk.com (no useful data)

Step 3: Data Synthesis

Combine all sources into a structured report:

## ARTIST ANALYSIS: [Name]

### PROFILE
- Spotify ID, verified status, profile completeness
- Monthly listeners (from web/browser)
- Followers (not available via API since Feb 2026)

### DISCOGRAPHY
- Albums/singles count, release timeline
- Featured appearances and collaborations
- Label/distribution info

### STREAMING PERFORMANCE (from kworb.net)
- Total tracked streams
- Top tracks by streams
- Chart peaks (country-specific)
- Average streams per release

### MARKET POSITION
- Related artists comparison
- Genre positioning
- Audience tier classification

### MONETIZATION ANALYSIS
- Estimated monthly streaming revenue
- Concert potential (based on ML tier)
- Sync licensing opportunities
- Merch potential

### RECOMMENDATIONS
- Specific growth opportunities
- Release strategy suggestions
- Collaboration targets

Step 4: Report Output

Save report as:

  • reports/artist-report-{name}-{date}.md for storage
  • Present summary in chat with key metrics

Scripts

All scripts are in this skill directory. Usage:

# Step 1: Spotify API data
python spotify_api_lookup.py "Artist Name"
python spotify_api_lookup.py --id SPOTIFY_ID

# Step 2: kworb.net data (automated via web_fetch in main flow)

# Step 3: Full report (combines all sources)
python generate_report.py "Artist Name"

Data Tiers — Artist Classification

TierMonthly ListenersRevenue PotentialExamples
Underground0-5K200-1K PLN/molocal acts
Emerging5-20K1-4K PLN/mofirst buzz
Developing20-60K4-12K PLN/mogrowing fanbase
Established Indie60-200K12-40K PLN/moMichał Anioł, schafter
Top Indie200-500K40-100K PLN/moQuebonafide tier
Mainstream500K-2M100-400K PLN/moDawid Podsiadło
Star2M-10M400K-2M PLN/mosanah, PRO8L3M
Mega-star10M+2M+ PLN/moglobal acts

Revenue Estimation Formula

Monthly streaming revenue = Monthly Streams × $0.003-0.005 (per stream)
Concert revenue = (Capacity × Ticket Price × 0.7) per show
Sync licensing = 5K-50K PLN per placement (one-time)

Spotify API — Available vs Removed (Feb 2026)

✅ Available Endpoints

  • GET /artists/{id} — Artist metadata (limited fields)
  • GET /artists/{id}/albums — Artist's albums
  • GET /albums/{id} — Album details
  • GET /albums/{id}/tracks — Album tracks
  • GET /tracks/{id} — Track details
  • GET /search — Search (max 10 results)
  • GET /me/player/currently-playing — Now playing
  • GET /me/player/recently-played — Recent tracks
  • GET /me/top/{type} — User's top artists/tracks
  • GET /me — Current user profile
  • GET /me/playlists — User's playlists
  • POST /me/playlists — Create playlist
  • PUT/DELETE /me/library — Save/remove items
  • Full player control endpoints

❌ Removed/Restricted Endpoints

  • GET /artists/{id}/top-tracks — REMOVED
  • GET /artists (bulk) — REMOVED
  • GET /tracks (bulk) — REMOVED
  • GET /albums (bulk) — REMOVED
  • GET /users/{id} — REMOVED
  • GET /users/{id}/playlists — REMOVED
  • GET /browse/new-releases — REMOVED
  • GET /browse/categories — REMOVED
  • GET /markets — REMOVED

⚠️ Removed Fields

  • Artist: followers, popularity
  • Track: popularity, available_markets, linked_from
  • Album: popularity, label, available_markets, album_group
  • User: country, email, followers, product, explicit_content

Error Handling

ErrorCauseSolution
403 on /top-tracksEndpoint removed Feb 2026Use kworb.net
404 on artist IDInvalid ID or regional restrictionCheck ID, try search
Missing followers/popularityDev Mode restrictionUse kworb.net or SfA
Encoding error (cp1250)Polish characters in outputReplace emojis with [OK]/[!]
web_search 404Token limit exceededUse web_fetch instead

Notes

  • Always cross-reference data from multiple sources
  • kworb.net is the most reliable source for streaming numbers
  • Spotify for Artists (SfA) dashboard has the richest data but requires manual access
  • web_search is currently unavailable (token limit) — use web_fetch on known URLs
  • Polish artist names may cause encoding issues — use ASCII-safe output

Version History

  • v1.0 (2026-03-16) — Initial skill creation, post-Spotify Feb 2026 changes

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…