Security audit
Security checks across malware telemetry and agentic risk
The skill is coherent for creating private Spotify audio episodes, but it uses high-impact setup, Spotify account access, raw bearer-token handling, connected personal data, and cloud providers with uneven consent and disclosure.
Install only if you are comfortable with a Spotify-connected tool that can save private episodes, manage timelines, and use local or cloud TTS/image providers. Review the installer before running it, do not expose the printed Spotify bearer token in logs or prompts, require explicit approval before setup and upload, and avoid using sensitive, confidential, or regulated content unless you have checked where the chosen providers will process it.
Every episode — regardless of content type — must complete these steps.
0. **Preflight: install, auth, and voice engine** — Run `save-to-spotify --json doctor` before any sourcing. This checks the binary, auth, TTS engines, and ffmpeg in one call. If the binary is missing, ask the user to confirm installation, install it with the command in the Install section after they approve, then run doctor again. If unauthenticated, run `save-to-spotify setup` directly (do not ask the user to run it — just run it). The setup command handles auth + TTS detection in one pass and auto-detects headless environments. **Then confirm a TTS engine is available** via the `tts_engines` field in the doctor output: if one is already set up or the user has a preference, use it; otherwise check for an existing API key (`OPENAI_API_KEY`, `ELEVENLABS_API_KEY`) and suggest that engine first — no install, higher quality. If no key is present, **ask the user** whether to install **Kokoro** (free, local, ~340 MB, [Apache-2.0 licensed](https://raw.githubusercontent.com/hexgrad/kokoro/refs/heads/main/LICENSE)) — put the license link in the question text above the choices, where markdown renders it clickable; never inside option labels, which are plain text. Do not install silently. If they accept, run `save-to-spotify tts setup`. Confirm an engine is *available* before scripting; the interactive voice pick and preview can be deferred until the content is approved — content before audio. Voice previews use the player page in [references/local-preview.md](references/local-preview.md) ("Voice preview page"), never auto-play.
1. **Interview** — Ask the user about preferences, including companion-image source. Present a plan and **wait for confirmation**
2. **Script** — Present a short chapter overview (compact numbered list, bold chapter names, one line each, no blank lines between items) and get it approved first (revising an outline is free; never dump a full transcript on the user), then write the
...[truncated 25 chars]## Design principles 1. **Always present choices, never ask for free text** — every decision point must be a list of options the user can pick from. Never ask the user to type something. Open-ended text input breaks the flow and creates friction. If you need input, present smart options and let them pick. And embed whatever the user is judging (chapter list, preview URL, file link) **inside the choice prompt itself** — plain text printed before a choice popup can be hidden by it, leaving the user a question about content they never saw 2. **Content before audio** — chapters are approved and the script written before any voice or audio work. Iterating on text costs nothing; regenerating audio does 3. **Show, don't tell** — script summaries, voice previews, and a local browser preview of the finished episode 4. **Default everything** — language, length, voice, cover, show, and content topic all have smart defaults
## Getting a bearer token `save-to-spotify token` prints the current access token to stdout. That token has been verified to work as a Spotify Web API `Bearer` token for requests against `api.spotify.com`, so agents do not need a separate app registration for the catalog lookups below. Guard the call because it exits non-zero when the stored token cannot be refreshed:
curl -fsSL https://saveto.spotify.com/install.sh | bash -s -- --version 0.2.0 # Custom directory curl -fsSL https://saveto.spotify.com/install.sh | bash -s -- --dir ~/.local/bin # Via environment variables SAVE_TO_SPOTIFY_VERSION=0.2.0 SAVE_TO_SPOTIFY_INSTALL_DIR=~/.local/bin \
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.