Use Soulseek to Chat and Share Files
v1.0.2Use Soulseek to search, download, and share files, chat in rooms or privately with users via its GUI or CLI tools.
⭐ 1· 1.9k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes installing and using Soulseek (GUI app, soulseek-cli, or aioslsk) which matches the skill name; requested actions (download, run client, search, chat, share) are coherent with that purpose.
Instruction Scope
The instructions tell the agent/user to download and run third-party binaries (Soulseek .exe/.dmg/.AppImage) and to set environment variables SOULSEEK_ACCOUNT and SOULSEEK_PASSWORD for the CLI. The skill metadata declared no required env vars, but the runtime steps explicitly ask for credentials — a scope mismatch. The instructions also lack guidance to verify downloads (checksums/signatures) and encourage sharing directories, which can leak private files if done carelessly.
Install Mechanism
This is an instruction-only skill (no install spec). It points to the official Soulseek site (slsknet.org) and GitHub repos (soulseek-cli, aioslsk), which are reasonable sources. However, the guidance still requires the user to download and execute binaries on their system, which carries the usual risks; the skill does not provide integrity verification instructions.
Credentials
The skill metadata lists no required env vars, but the SKILL.md instructs users to export SOULSEEK_ACCOUNT and SOULSEEK_PASSWORD for the CLI. Requesting credentials is expected for CLI usage, but the metadata omission is an incoherence. Storing passwords in plain environment variables and using them in an agent context can risk accidental credential exposure.
Persistence & Privilege
The skill is not always-enabled, has no install footprint, and does not request persistent system privileges or modify other skills. No elevated persistence is requested.
What to consider before installing
This skill appears to be what it says — instructions for installing and using Soulseek — but be cautious before proceeding. Practical points:
- The SKILL.md asks you to download and run executables (Windows .exe, macOS .dmg, Linux .AppImage). Only download from the official project pages and verify checksums/signatures when available.
- The CLI instructions tell you to export SOULSEEK_ACCOUNT and SOULSEEK_PASSWORD, but the skill metadata does not declare these as required env vars. Treat this as an oversight: avoid putting real passwords into shell env vars that might get logged; use a secrets manager or temporary account if possible.
- Be careful what directories you share; P2P file sharing can accidentally expose personal files.
- If you plan to use the CLI or libraries, prefer creating a throwaway account, and run the client in a sandboxed environment (VM/container) if you are concerned about running third-party binaries.
- If you want higher assurance, ask the skill author to update the metadata to declare the required env vars and to add guidance on verifying downloads (checksums/GPG) and safer credential handling.Like a lobster shell, security has layers — review code before you run it.
latestvk979ts00zkqcq0srfdz3e6fhkn809161
License
MIT-0
Free to use, modify, and redistribute. No attribution required.