Security audit
Security checks across malware telemetry and agentic risk
This playlist DJ skill is mostly purpose-aligned, but it needs review because it controls Music.app by default and has unsafe AppleScript query handling.
Review before installing. Use only if you are comfortable with a skill reading your Music.app library metadata, controlling playback on macOS, caching playlist data under your home directory, and sending city-based weather lookups to wttr.in. Avoid passing arbitrary search text until AppleScript string escaping or another safe query mechanism is added, and prefer --no-play when you only want recommendations.
def _run(script: str, timeout: int = 10) -> str:
try:
r = subprocess.run(["osascript", "-e", script],
capture_output=True, text=True, timeout=timeout)
return r.stdout.strip()
except Exception as e:def _run(script: str, timeout: int = 10) -> str:
try:
r = subprocess.run(["osascript", "-e", script],
capture_output=True, text=True, timeout=timeout)
return r.stdout.strip()
except Exception as e:VirusTotal findings are pending for this skill version.
No suspicious patterns detected.