ClawHub
Back to skill

Security audit

Spotify Player

Security checks across malware telemetry and agentic risk

Overview

This Spotify terminal skill is mostly purpose-aligned, but it asks users to import authentication cookies from Chrome without explaining the credential risk or storage boundaries.

Install only if you trust the `spogo` CLI and are comfortable letting it import Spotify authentication from your Chrome profile. Prefer an official OAuth or device-code login if available, and verify where imported tokens are stored and how to revoke or remove them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs users to import Spotify browser cookies from Chrome, which are sensitive session artifacts that can enable account access if mishandled. Even if intended for legitimate CLI authentication, the documentation provides no warning, consent guidance, or safety boundaries around extracting browser session data, increasing the risk of unsafe credential handling.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
- Either `spogo` or `spotify_player` installed.

spogo setup
- Import cookies: `spogo auth import --browser chrome`

Common CLI commands
- Search: `spogo search track "query"`
Confidence
89% confidence
Finding
cookies: `spogo auth import --browser chrome

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.