sonos

Control Sonos speakers (discover/status/play/volume/group).

Security Scan

The skill is internally consistent: it simply wraps the sonos CLI, requests the sonos binary (or installs it via a public Go module), and does not ask for unrelated credentials or escalate privileges.

Purpose & Capability

Name/description match the declared requirements: the skill requires the 'sonos' CLI binary and the SKILL.md shows commands to control Sonos speakers (discover/status/play/volume/group). The go install target (github.com/steipete/sonoscli/...) is the expected upstream for a sonos CLI.

Instruction Scope

Runtime instructions are limited to invoking the local 'sonos' CLI against devices on the local network and an optional Spotify Web API search (which is clearly documented as requiring SPOTIFY_CLIENT_ID/SECRET). The SKILL.md does not instruct the agent to read unrelated files, environment variables, or exfiltrate data.

Install Mechanism

Install uses a public Go module (github.com/steipete/sonoscli/cmd/sonos@latest) to build/install the 'sonos' binary. This is a typical approach but carries the usual moderate risk of fetching/building third‑party code at install time — not immediately suspicious but worth verifying the upstream repo before installing.

Credentials

No required environment variables or credentials are declared. The SKILL.md documents optional SPOTIFY_CLIENT_ID/SECRET for Spotify Web API search — this is proportional and optional.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It will invoke a local binary (or install one) and run it; that is expected for a CLI wrapper.

Assessment

This skill appears to do what it says: control Sonos devices via the 'sonos' CLI. Before installing, you should: (1) verify the upstream Go module/repository (github.com/steipete/sonoscli) so you trust the code being fetched and built; (2) be aware the CLI will access your local network to discover/control speakers; (3) only provide SPOTIFY_CLIENT_ID/SECRET if you need Spotify search and trust the integration; and (4) if you prefer, install or audit the 'sonos' binary yourself (rather than allowing the skill to fetch/build it) to reduce supply-chain risk.

Sonos CLI

Use sonos to control Sonos speakers on the local network.

Quick start

• sonos discover
• sonos status --name "Kitchen"
• sonos play|pause|stop --name "Kitchen"
• sonos volume set 15 --name "Kitchen"

Common tasks

• Grouping: sonos group status|join|unjoin|party|solo
• Favorites: sonos favorites list|open
• Queue: sonos queue list|play|clear
• Spotify search (via SMAPI): sonos smapi search --service "Spotify" --category tracks "query"

Notes

• If SSDP fails, specify --ip <speaker-ip>.
• Spotify Web API search is optional and requires SPOTIFY_CLIENT_ID/SECRET.