Home Music Enhanced

PassAudited by ClawScan on May 12, 2026.

Overview

This skill appears to do what it claims—control local Spotify and Airfoil music scenes—but users should verify the local helper path and the optional sudo symlink before installing.

Before installing, confirm you are on macOS with Spotify and Airfoil, review home-music.sh, update the hard-coded Spotify helper path and speaker names for your machine, and run the sudo symlink only if you want a persistent global command. The skill can play, pause, route, and change volume for your local speakers.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running a scene can connect or disconnect speakers and change playback volume across the home.

Why it was flagged

The script runs local AppleScript commands to control Airfoil speakers. This is expected for a macOS music-routing skill, but it does change local application and device state.

Skill content
osascript -e "tell application \"Airfoil\" to connect to (first speaker whose name is \"$speaker\")" 2>/dev/null || true
Recommendation

Install only if you expect this local automation, and review or adjust the speaker names and volume levels before using party or whole-house scenes.

What this means

If the helper path points to an unexpected or modified script, the skill would run that local script when controlling Spotify.

Why it was flagged

The skill delegates Spotify control to a hard-coded helper script path outside this package. That helper is purpose-aligned, but its code is not included in the provided artifacts.

Skill content
SPOTIFY_CMD="/Users/asteinberger/clawd/skills/spotify-applescript/spotify.sh"
Recommendation

Verify the spotify-applescript helper before use and change the path to a trusted local installation under your own account.

What this means

The home-music command will remain available system-wide until the symlink is removed or changed.

Why it was flagged

The installation instructions ask the user to create a persistent global command symlink in a privileged directory. This is a common CLI setup pattern and is user-directed, but it should be done knowingly.

Skill content
sudo ln -sf ~/clawd/skills/home-music/home-music.sh /usr/local/bin/home-music
Recommendation

Only run the sudo symlink command after reviewing the script, and remove the symlink if you no longer want the command installed globally.