statsfm
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent read-only stats.fm music analytics skill, but it can query personal listening history and may make many API calls when given a username.
Install if you are comfortable with an agent querying stats.fm for music analytics. For personal questions, provide or confirm the intended stats.fm username, limit date ranges when desired, and avoid sharing results that reveal listening habits you consider private.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may query more of a stats.fm profile or listening history than a minimal answer requires.
The instructions explicitly encourage repeated API usage and broad investigation, which is coherent with music analysis but can exceed the minimum data needed for a simple question.
You're a music analyst with unlimited API calls — act like it.
Ask for specific time ranges or concise analysis if you want to limit how much listening data is retrieved.
Your listening history, top music, and currently-playing information may be shown to the agent and included in responses.
The skill accesses account-derived personal music data by username. This is the stated purpose and does not require credentials, but the data can still be privacy-sensitive.
With a stats.fm username, query personal Spotify listening history, play counts, top artists/tracks/albums, monthly breakdowns, and currently playing.
Only provide a stats.fm username you are comfortable analyzing, and review your stats.fm privacy settings if the profile contains sensitive listening data.
If memory contains an outdated or incorrect username, the agent could analyze the wrong stats.fm profile.
The skill directs the agent to reuse a remembered username, which is convenient but means a persistent identifier may influence which profile is queried.
Check memory for a stats.fm username. If you don't have one, ask — all personal commands need `--user USERNAME` (`-u`).
Confirm the username before personal queries, especially on shared devices or when switching accounts.