← Back to Skills Marketplace
Spotify Player
by
Peter Steinberger
· GitHub ↗
· v1.0.0
28126
Downloads
55
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install spotify-player
Description
Terminal Spotify playback/search via spogo (preferred) or spotify_player.
Usage Guidance
Review this skill before installing. Only run the Chrome cookie import if you trust the installed spogo binary and understand that browser cookies can act like account credentials. Prefer a safer OAuth or device-login flow where available, and verify the tool source before granting it browser profile access.
Capability Analysis
Type: OpenClaw Skill
Name: spotify-player
Version: 1.0.0
The skill bundle is classified as suspicious due to the `spogo auth import --browser chrome` command specified in `SKILL.md`. This command accesses sensitive browser cookies for authentication, which, while plausibly needed for the stated purpose of a Spotify player, represents a high-risk capability that could be abused. There is no clear evidence of intentional malicious behavior or prompt injection against the agent for data exfiltration or unauthorized actions within the provided files, but the direct access to browser data warrants a 'suspicious' classification.
Capability Assessment
Credentials
Playback and search commands are proportionate to the stated purpose, but granting a local external binary access to Chrome cookie storage is broader and more sensitive than ordinary Spotify playback control unless the user clearly understands and approves that trust boundary.
Install Mechanism
The skill has no bundled executable code, but metadata installs spogo from the third-party Homebrew tap `steipete/tap` without a pinned version or independent integrity information. This is more concerning because the installed binary is later used for cookie import.
Instruction Scope
The runtime instructions tell users to run `spogo auth import --browser chrome` without explaining that browser cookies are sensitive credentials, what profile or domains are accessed, where imported material is stored, or requiring explicit user control at the moment of access.
Persistence & Privilege
No system persistence, privilege escalation, services, hooks, or background workers are present in the artifact. The skill notes spotify_player configuration under `~/.config/spotify-player`, which is ordinary local app configuration.
Purpose & Capability
The skill purpose is terminal Spotify playback and search, and the documented spogo/spotify_player commands fit that purpose. Authentication is expected for Spotify control, but browser cookie import crosses into sensitive session data.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install spotify-player - After installation, invoke the skill by name or use
/spotify-player - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Metadata
Frequently Asked Questions
What is Spotify Player?
Terminal Spotify playback/search via spogo (preferred) or spotify_player. It is an AI Agent Skill for Claude Code / OpenClaw, with 28126 downloads so far.
How do I install Spotify Player?
Run "/install spotify-player" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Spotify Player free?
Yes, Spotify Player is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Spotify Player support?
Spotify Player is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Spotify Player?
It is built and maintained by Peter Steinberger (@steipete); the current version is v1.0.0.
More Skills