Home Music

PassAudited by ClawScan on May 12, 2026.

Overview

This is a coherent local music-control skill, but it can change speaker routing and playback and depends on local helper scripts and a sudo-created command symlink.

Before installing, confirm that you use macOS with Spotify Desktop and Airfoil, review the speaker names and playlist URIs, and verify the separate spotify-applescript helper path. Avoid running the sudo symlink command unless you want a persistent global terminal command.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked, the skill can start music, change volume, and connect or disconnect multiple household speakers.

Why it was flagged

The script uses local automation to connect speakers, set volumes, and start Spotify playback. This is expected for a whole-house music skill, but it affects the user's physical environment.

Skill content

for speaker in "${ALL_SPEAKERS[@]}"; do
        airfoil_connect "$speaker"
        sleep 0.3
        airfoil_volume "$speaker" 0.7
    done
    
    "$SPOTIFY_CMD" play "$PLAYLIST_PARTY"

Recommendation

Review the configured scenes and speaker names before use, and ask the agent to confirm before running louder or whole-house scenes such as party mode.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If that local helper is missing, modified, or untrusted, Spotify actions may fail or behave according to that separate script.

Why it was flagged

Spotify control is delegated to an absolute-path helper script that is not included in this package. The dependency is disclosed in SKILL.md, but its code and provenance are outside the reviewed artifacts.

Skill content

SPOTIFY_CMD="/Users/asteinberger/clawd/skills/spotify-applescript/spotify.sh"

Recommendation

Install and review a trusted spotify-applescript helper, then update the path to match your own Claw installation.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The home-music command will remain available globally until the symlink is removed, and an existing command with the same name could be overwritten.

Why it was flagged

The documented setup creates or replaces a global command symlink using sudo. This is a user-directed install convenience, not hidden persistence, but it modifies a system command directory.

Skill content

sudo ln -sf ~/clawd/skills/home-music/home-music.sh /usr/local/bin/home-music

Recommendation

Run the sudo symlink command only if you want global terminal access; otherwise use a user-local bin directory or call the script by its full path.