Security audit
Security checks across malware telemetry and agentic risk
This karaoke and lyrics skill uses expected song search, translation, local file, and optional Music.app features, with some privacy and terminal-display cautions but no evidence of deception or harmful behavior.
Install only if you are comfortable sending lyric/search text to LRCLIB, DuckDuckGo, and LibreTranslate, and with optional Music.app sync reading the currently playing track metadata. Avoid opening untrusted lyric files or using suspicious track metadata in a terminal until control-character sanitization is added.
set d to duration of t
return n & "||" & a & "||" & (d as string)
end tell'''
out = subprocess.run(["osascript", "-e", script],
capture_output=True, text=True, timeout=5)
parts = out.stdout.strip().split("||")
if len(parts) >= 3:64/64 vendors flagged this skill as clean.
No suspicious patterns detected.