Music Identify

Identify songs from audio clips using AudD API and optionally queue them to Spotify. Triggers on /songsearch command, voice messages with song identification...

This skill appears to do what it says, but before installing consider: - It stores secrets as files: AudD API key (~/.config/audd/api_key) and Spotify credentials/tokens (~/.config/spotify/). Make sure those files are created with restrictive permissions (chmod 600) and store only credentials you trust. - The Spotify auth script runs a temporary HTTP server bound to 0.0.0.0:8888 to receive the OAuth callback. If you expose that port via a public tunnel (ngrok, Tailscale Serve, etc.), anyone who can reach it could attempt to hit the callback; prefer using a local-only redirect URI or ensure the tunnel is private. - The skill appends identifications to memory/music-log.json; this creates a persistent local history of songs you asked about. If that is sensitive, periodically rotate or delete the file or change where it is written. - AudD requests audio files to api.audd.io; check AudD's privacy/retention policy before sending audio you consider private. Also keep track of API usage limits/costs. - The scripts are plain and readable (no obfuscated code). If you have stricter security requirements, inspect the scripts yourself before running and consider running the auth flow on an isolated machine. If these behaviors are acceptable (local credential files, local log, and a temporary auth server), the skill is coherent and can be used. If you are uncomfortable with any of the above, do not install or modify the scripts to match your security posture (for example, change the redirect URI to a localhost-only address, encrypt stored tokens, or change the memory log location).

Type: OpenClaw Skill Name: music-identify Version: 1.2.0 The music-identify skill is a well-structured tool for song identification using the AudD API and optional Spotify integration. The scripts (identify.sh, spotify-queue.sh, and spotify-auth.py) perform standard API interactions, handle OAuth flows correctly, and use jq for safe JSON processing. The documentation in SKILL.md correctly identifies necessary credentials and recommends restrictive file permissions (chmod 600), with no evidence of data exfiltration, malicious execution, or prompt injection.