sonoscli
Warn
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill installs the
sonosbinary usinggo installfromgithub.com/steipete/sonoscli/cmd/sonos@latest. This repository is not on the pre-approved list of trusted GitHub organizations or repositories, making the dependency unverifiable via static analysis. - [COMMAND_EXECUTION] (LOW): The skill relies on executing the
sonosCLI tool to perform actions like discovery, volume control, and grouping. This is consistent with its primary purpose but represents a capability that could be misused if coupled with malicious instructions. - [CREDENTIALS_UNSAFE] (SAFE): The documentation mentions the use of
SPOTIFY_CLIENT_IDandSPOTIFY_SECRETfor optional Spotify features. No hardcoded credentials were found; these are referenced as environment variables to be provided by the user.
Audit Metadata