Spotify Player

Terminal Spotify playback/search via spogo (preferred) or spotify_player.

Security Scan

The skill is an instruction-only wrapper that tells the agent to use local CLI tools (spogo or spotify_player) for Spotify playback; its requirements and instructions are consistent with that purpose.

Purpose & Capability

Name/description (terminal Spotify playback/search) matches the instructions: they require either the spogo or spotify_player CLI and a Spotify Premium account. Nothing requested (no env vars, no unexpected credentials) is outside that purpose.

Instruction Scope

SKILL.md confines actions to running local CLI commands (search, play, device list/set, status) and referencing a local config folder (~/.config/spotify-player). One instruction (spogo auth import --browser chrome) implies importing browser cookies — this may require the user to grant access to browser cookie storage when running that CLI, but the skill's instructions themselves do not ask the agent to read other arbitrary files or exfiltrate data.

Install Mechanism

The registry shows no formal install spec, but SKILL.md metadata suggests Homebrew installs: spogo from the third-party tap steipete/tap and spotify_player. Homebrew installs are common and expected for CLIs, but a third-party tap means code comes from a non-core source — users may want to inspect the tap/formula before installing.

Credentials

No environment variables or credentials are requested. The skill references a local config path and the optional client_id setting for Spotify Connect; this is proportionate and expected for a local CLI-based Spotify client.

Persistence & Privilege

Skill is user-invocable, not always-on, and does not request persistent system privileges or modify other skills. It does not ask to store credentials in the agent or change global agent settings.

Assessment

This is an instruction-only skill that expects you to have (or install) a local Spotify CLI (spogo preferred, or spotify_player). Before installing or using it: 1) verify the Homebrew tap/formula sources (spogo is suggested from steipete/tap — a third-party tap), 2) understand that running spogo auth import may access your browser cookie store to authenticate (so run that command yourself and review what it does), 3) the skill does not request API keys or environment secrets, but it does use a local config (~/.config/spotify-player) where you may place a client_id for Spotify Connect — keep sensitive tokens out of config unless you trust the tool, and 4) if you don’t want the agent to run these CLI commands automatically, only invoke the skill manually or change invocation settings.

spogo / spotify_player

Use spogo (preferred) for Spotify playback/search. Fall back to spotify_player if needed.

Requirements

• Spotify Premium account.
• Either spogo or spotify_player installed.

spogo setup

• Import cookies: spogo auth import --browser chrome

Common CLI commands

• Search: spogo search track "query"
• Playback: spogo play|pause|next|prev
• Devices: spogo device list, spogo device set "<name|id>"
• Status: spogo status

spotify_player commands (fallback)

• Search: spotify_player search "query"
• Playback: spotify_player playback play|pause|next|previous
• Connect device: spotify_player connect
• Like track: spotify_player like

Notes

• Config folder: ~/.config/spotify-player (e.g., app.toml).
• For Spotify Connect integration, set a user client_id in config.
• TUI shortcuts are available via ? in the app.