Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Music Discovery

v1.0.0

Recommend music tracks and playlists tailored to mood, activity, BPM, energy, or genre using Spotify and Last.fm data.

0· 103·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for codenova58/music-discovery.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Music Discovery" (codenova58/music-discovery) from ClawHub.
Skill page: https://clawhub.ai/codenova58/music-discovery
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install music-discovery

ClawHub CLI

Package manager switcher

npx clawhub@latest install music-discovery
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description promise Spotify/Last.fm-style discovery, but the included Python tool does not call any external APIs, does not import requests or spotipy, and only records local usage to a data file. Declared capabilities (data-backed discovery using Spotify/Last.fm) are not implemented in the code bundle.
!
Instruction Scope
SKILL.md instructs installing requests and spotipy and refers to OAuth/rate-limits, but gives no instructions to supply credentials or environment variables. Usage examples point to a non-existent path (docs show scripts/skills/music-discovery/scripts/... while the repo has scripts/music_discovery_tool.py), so following the docs will fail. The instructions are incomplete and inconsistent with the packaged code.
Install Mechanism
There is no install spec (instruction-only skill), which is low-risk from an installer standpoint. The only effect of running the tool is local file writes under the repo's data/ directory; no external downloads or archive extraction are present.
Credentials
The skill declares no required environment variables or primary credential, but the README explicitly references OAuth for Spotify and suggests using real API data. The absence of declared env vars is an inconsistency: if real Spotify integration is intended, credentials would be required but are not specified in the metadata.
Persistence & Privilege
always is false and the skill does not request persistent or elevated privileges. It only writes to a repository-local data file and does not modify system-wide configuration or other skills.
What to consider before installing
This package looks like a placeholder/CLI stub rather than a working Spotify/Last.fm integrator. Before installing or running it: (1) don't provide your Spotify credentials to it until the author documents how they are used and where secrets are stored; (2) verify the code path and usage examples (SKILL.md points to a path that doesn't exist); (3) inspect the Python file locally — it currently only writes a local data file and does not call external APIs; (4) if you expect real API-backed recommendations, request the author to (a) implement/declare API calls, (b) list required env vars (client ID/secret or tokens) in metadata, and (c) fix usage paths; (5) run in a sandbox or limited environment if you want to test. These inconsistencies could be harmless (incomplete skill) but warrant caution.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bawm029sytkknfmatnmwdzh83ks9x
103downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Music Discovery — Mood, Scene & Playlists

Overview

Helps listeners find tracks and playlists that fit a mood, activity, or taste profile—study, commute, workout, sleep, or “something like this artist.” Use when the user wants personalized picks, scene-based sets, or exploration without manual crate-digging.

Trigger keywords: music recommendation, playlist, mood, BPM, study music, workout, discover similar artists

Prerequisites

pip install requests spotipy

Capabilities

  1. Data-backed discovery — Spotify Web API / Last.fm–style metadata (see references/music_discovery_guide.md).
  2. Scene-based sets — work, workout, wind-down, commute, focus, party.
  3. Vibe matching — BPM, energy, valence/mood tags, genre boundaries.

Commands

CommandDescriptionExample
recommendRecommend trackspython3 scripts/skills/music-discovery/scripts/music_discovery_tool.py recommend [args]
playlistBuild a playlist conceptpython3 scripts/skills/music-discovery/scripts/music_discovery_tool.py playlist [args]
moodRecommend by moodpython3 scripts/skills/music-discovery/scripts/music_discovery_tool.py mood [args]

Usage (from repository root)

python3 scripts/skills/music-discovery/scripts/music_discovery_tool.py recommend --scene office --mood relaxed
python3 scripts/skills/music-discovery/scripts/music_discovery_tool.py playlist --scene workout --bpm 140
python3 scripts/skills/music-discovery/scripts/music_discovery_tool.py mood --feeling happy

Output format (for the agent’s report)

# Music Discovery report

**Generated**: YYYY-MM-DD HH:MM

## Key picks
1. [Track / artist — one-line why]
2. …
3. …

## Snapshot
| Title | Artist | Why it fits |
|-------|--------|---------------|

## Playlist sketch (optional)
- **Theme**: …
- **Tempo / energy**: …
- **Avoid**: …

## Notes
[Ground claims in API or user-stated taste—no invented chart positions.]

References

APIs & libraries

Patterns & community

Notes

  • Prefer real API or user-provided data; do not invent popularity or audio features.
  • Mark missing fields as unavailable instead of guessing.
  • OAuth and rate limits apply when using Spotify—document when credentials are required.

Comments

Loading comments...