spotify-player
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill metadata specifies installation for
spogoandspotify_playerusing the Homebrew package manager, referencing a third-party tap (steipete/tap) and a standard formula.\n- [COMMAND_EXECUTION]: The skill primarily functions by executing shell commands for thespogoandspotify_playerbinaries to control playback, search for tracks, and manage devices.\n- [CREDENTIALS_UNSAFE]: The skill instructs the agent to import browser cookies via the commandspogo auth import --browser chrome. This operation involves programmatic access to sensitive authentication tokens stored in the browser profile.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external search queries and device names that are interpolated into shell commands.\n - Ingestion points: User-supplied track search terms and device names in
spogoandspotify_playercommand arguments.\n - Boundary markers: None. No delimiters or instruction-ignore warnings are defined for the user input.\n
- Capability inventory: The skill can execute commands to play, pause, and search via the system shell.\n
- Sanitization: There is no evidence of validation or escaping for input used in CLI arguments.
Audit Metadata