Spotify Skill

Control Spotify playback, search music, manage playlists, generate discovery playlists, and analyze listening habits via the Spotify Web API. Use when asked...

This skill appears to do what it says: it uses the Spotify OAuth flow and the Web API to control playback and manage playlists. Before installing: (1) understand you must create a Spotify developer app and supply the client_id and client_secret; (2) the skill saves OAuth tokens and your client credentials to a local config.json (plaintext) in the skill directory — consider using environment variables and restrict file permissions (chmod 600) or remove the file after use; (3) the OAuth scopes requested are broad (playback, modify playlists, read/save library, etc.) — grant only if you accept that access; (4) run the initial auth on a machine you control (it opens a browser and asks you to paste an authorization code), and revoke the app from your Spotify account if you later want to remove access; (5) if you are not comfortable storing client secrets or tokens locally, review or modify the scripts to change storage behavior before use.

Type: OpenClaw Skill Name: spotify-agent Version: 1.1.1 The Spotify Agent skill provides standard functionality for controlling Spotify playback, searching music, and managing playlists via the Spotify Web API. The implementation in scripts/auth.py and scripts/spotify.py uses Python's standard library to handle OAuth2 flows and API requests, storing credentials locally in a configuration file. There is no evidence of data exfiltration, unauthorized network calls, or malicious command execution; the logic is entirely consistent with the stated purpose of a music management tool.