Home Music

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: home-music-terry Version: 1.1.1 The skill is a macOS-specific automation tool designed to coordinate Spotify playback with Airfoil speaker routing. It uses AppleScript (via osascript) to control the applications, which is a standard method for macOS automation. While the script contains a hardcoded user path (/Users/asteinberger/...) for a dependency, this is a configuration flaw rather than a security vulnerability or malicious intent. The installation instructions involving sudo for symlinking are standard for CLI tools, and the script's logic is strictly limited to the stated purpose of managing music scenes.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked, the skill can start music, change volume, and connect or disconnect multiple household speakers.

Why it was flagged

The script uses local automation to connect speakers, set volumes, and start Spotify playback. This is expected for a whole-house music skill, but it affects the user's physical environment.

Skill content

for speaker in "${ALL_SPEAKERS[@]}"; do
        airfoil_connect "$speaker"
        sleep 0.3
        airfoil_volume "$speaker" 0.7
    done
    
    "$SPOTIFY_CMD" play "$PLAYLIST_PARTY"

Recommendation

Review the configured scenes and speaker names before use, and ask the agent to confirm before running louder or whole-house scenes such as party mode.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If that local helper is missing, modified, or untrusted, Spotify actions may fail or behave according to that separate script.

Why it was flagged

Spotify control is delegated to an absolute-path helper script that is not included in this package. The dependency is disclosed in SKILL.md, but its code and provenance are outside the reviewed artifacts.

Skill content

SPOTIFY_CMD="/Users/asteinberger/clawd/skills/spotify-applescript/spotify.sh"

Recommendation

Install and review a trusted spotify-applescript helper, then update the path to match your own Claw installation.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The home-music command will remain available globally until the symlink is removed, and an existing command with the same name could be overwritten.

Why it was flagged

The documented setup creates or replaces a global command symlink using sudo. This is a user-directed install convenience, not hidden persistence, but it modifies a system command directory.

Skill content

sudo ln -sf ~/clawd/skills/home-music/home-music.sh /usr/local/bin/home-music

Recommendation

Run the sudo symlink command only if you want global terminal access; otherwise use a user-local bin directory or call the script by its full path.