spoti-cli
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various
spoti-clicommands (e.g.,search,recommend,create,me) to interact with the Spotify API. These commands are integral to the skill's primary function of managing music playlists. - [COMMAND_EXECUTION]: Uses the
opencommand to launch Spotify URIs (spotify:playlist:...) or web URLs. This is a standard system operation for opening resources in their default applications. - [EXTERNAL_DOWNLOADS]: Instructs the user to install the
spoti-cliutility globally usingbun add -g spoti-cli. This is a standard prerequisite for using the tool and is performed by the user during initial setup. - [DATA_EXPOSURE]: The skill reads local files from the user's Obsidian vault (specifically
02_Journal/daily/{YYYY-MM-DD}.md) to infer mood for playlist generation. This access is explicitly described as a feature ('Vault-aware') and serves the primary purpose of the skill without signs of exfiltration.
Audit Metadata