Apple Music

Apple Music integration via AppleScript (macOS) or MusicKit API

This skill appears to be a genuine Apple Music integration guide, but several mismatches deserve attention before installing: - Platform mismatch: The SKILL.md relies on macOS AppleScript (osascript). If you plan to run agents on Windows/Linux, AppleScript parts won't work — the registry entry should have been restricted to macOS. - Missing credentials handling: MusicKit requires developer and user tokens. The skill does not declare required env vars or explain how tokens are provided/stored. Ask the author how MusicKit auth is expected to be supplied and where secrets are kept. - Source trust: The skill lists no homepage and an unknown owner ID. Prefer skills with a verifiable repository or homepage; lack of provenance increases risk if the skill ever requests or handles tokens. - Privacy: The AppleScript examples show reading track lists, played date, and other personal library metadata. Running the skill will expose your local Music library data to whatever the agent logs or transmits — ensure you understand whether outputs are kept locally or sent externally. - Operational safety: Because the skill runs osascript snippets, confirm that the agent will only execute AppleScript targeting the Music app and that it will require explicit user confirmation before running arbitrary scripts. Ask for explicit limits (e.g., 'only run these approved commands') and for the skill to declare required env vars for MusicKit if API use is intended. If you still want to proceed, request that the publisher: 1) Restrict the skill to macOS in metadata or clearly separate macOS vs MusicKit variants; 2) Declare required env vars (developer token, user token) and where they should be set; 3) Provide a homepage/repository for audit and a contact for questions; 4) Explain whether the agent will transmit library data externally and include safeguards (user confirmations, scope-limited scripts). Given these gaps, do not enable this skill for autonomous use on shared or sensitive systems until the above clarifications are provided.

Type: OpenClaw Skill Name: mcp-applemusic Version: 1.0.6 The skill bundle is suspicious due to two main factors: it instructs the agent to execute arbitrary AppleScript commands via `osascript` on macOS, which is a powerful local execution primitive, and it directs the agent to clone and install an external GitHub repository (`https://github.com/epheterson/mcp-applemusic.git`) using `git clone` and `pip install`. While the provided AppleScript examples are confined to the 'Music' application and the external repository is not analyzed here, the instruction to fetch and execute code from an external source introduces a significant supply chain risk, and the `osascript` capability, though currently benign, offers broad local execution potential.