Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
spotify-download
v1.0.0Download MP3s from Spotify playlists by fetching metadata, searching YouTube for tracks, and converting audio using ffmpeg with optional Spotify API credenti...
⭐ 0· 74·0 current·0 all-time
byWang Zesong@wgzesg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md behavior (fetch Spotify metadata, search YouTube, download/convert with yt-dlp and ffmpeg) is coherent with the name/description. However, the registry metadata declares no required binaries or env vars while the instructions clearly require Python 3.10+, ffmpeg, and yt-dlp and reference optional Spotify credentials. The discrepancy between metadata and SKILL.md is noteworthy.
Instruction Scope
Instructions stay within the stated task: fetch playlist metadata (embed or API), search YouTube, download audio, and convert to MP3. They do not direct the agent to read unrelated system files or exfiltrate arbitrary data. They do reference setting SPOTIFY_CLIENT_ID/SECRET as environment variables (optional) which are relevant to the task but were not declared in the registry metadata.
Install Mechanism
There is no install spec in the registry, but SKILL.md instructs users to install a third-party 'spotify-download' package via pip/pipx or clone a GitHub repo (https://github.com/zesong/spotify-download.git). It also references 'uvx' as an invocation method. Installing packages from PyPI or cloning arbitrary GitHub repos executes external code and is higher risk; the skill metadata should have declared these dependencies or an install mechanism to allow review. The lack of an official homepage and unknown owner increases the need for caution.
Credentials
The only credentials mentioned are optional Spotify Client ID/Secret, which are proportional to the stated need for accessing private playlists or improving metadata. However, the registry did not list these env vars as optional fields even though SKILL.md instructs how to set them. No other credentials are requested, which is appropriate. Users should avoid supplying long-lived production credentials unless necessary.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not ask to modify other skills or system-wide configs. Autonomous model invocation is enabled by default but is not, on its own, a red flag here.
What to consider before installing
This skill's runtime instructions align with its purpose, but the registry metadata omits key requirements and it directs you to install third-party packages and a GitHub repo. Before installing or running: 1) Confirm the source: inspect the referenced GitHub repo (https://github.com/zesong/spotify-download.git) and the PyPI package code to ensure no unexpected behavior. 2) Install supporting binaries (ffmpeg, yt-dlp) from trusted package managers (Homebrew, apt, Chocolatey or official project sites). 3) Avoid supplying your primary Spotify credentials unless necessary; use a disposable app/client if possible and revoke it after use. 4) Be aware of legal/terms-of-service issues when downloading copyrighted music—this may be prohibited in your jurisdiction or by service terms. 5) Ask the publisher to update registry metadata to declare required binaries and optional env vars so the skill's footprint is clear. Additional evidence (packaged code, a verified homepage, or a trustworthy publisher) would raise confidence.Like a lobster shell, security has layers — review code before you run it.
latestvk9782e5wn6b2xgn6bwfmwzgyhn83dbdk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.