Music Player for Windows

Provides music search, high-quality download, ID3 metadata embedding, and local playback on Windows using multiple music API sources.

This skill appears to do what it claims: search music via public APIs, download MP3s, embed ID3 tags, and open them in the default player. Before installing or running it: 1) Review and, if possible, run the scripts in an isolated environment (VM) because they download content from external servers. 2) Confirm the third‑party API endpoints used (music-api.caorushizi.cn, api.uomg.com) are trustworthy for your use; these are required for functionality and will receive requests and potentially logs. 3) Be aware of copyright/legal issues when downloading music — the code does not enforce licensing. 4) The docs mention installing python-pptx though it is unused in the code; you can omit that dependency. 5) The PUBLISH_GUIDE suggests 'clawhub login' — never paste credentials into unfamiliar services; only authenticate to platforms you trust. If you need higher assurance, request the author's source repository or run a security review in a sandbox before giving this skill network or file-system access.

Type: OpenClaw Skill Name: music-player Version: 1.1.0 The skill bundle exhibits several high-risk vulnerabilities and anomalies. Most significantly, scripts like 'download.py', 'play_music.py', and 'embed_metadata.py' lack input sanitization for file paths, which could allow an attacker to perform arbitrary file writes or execute arbitrary programs via 'os.startfile' if the agent is manipulated. Additionally, 'package.json' and 'SKILL.md' list 'python-pptx' as a dependency despite it being entirely unused in the codebase, and multiple scripts contain hardcoded absolute paths to a specific Windows 'Administrator' profile, suggesting a non-standard or poorly sanitized development environment.