MusicBrainz Importer

Look up and add music metadata on MusicBrainz. Use when asked to check if an artist, album, or release exists on MusicBrainz, find MusicBrainz entries linked...

This skill appears to do what it says: MusicBrainz lookups and adding releases using Playwright. Before installing, consider: (1) Playwright will download Chromium (large binary) and requires Node — allow that only if you trust the source. (2) You must store your MusicBrainz username/password in ~/.openclaw/skills/musicbrainz/.credentials.json (plaintext). If you install, restrict file permissions (chmod 600) or use an account with limited rights, and remove credentials when not needed. (3) The seed HTML writer uses basic quote escaping only—avoid feeding it untrusted JSON. (4) Review and test preflight.sh locally (it attempts a curl login) so you understand what data is transmitted. If any of these are unacceptable, do not install or modify the scripts to suit your security posture.

Type: OpenClaw Skill Name: musicbrainz-importer Version: 1.1.0 The skill provides legitimate MusicBrainz automation but employs several high-risk patterns, including browser automation (Playwright) for automated login and data entry, and local storage of plaintext credentials in `.credentials.json`. It frequently executes shell commands via `execSync` and Bash scripts (`scripts/preflight.sh`, `scripts/mb_lookup.sh`) to manage environment paths and perform network requests to `musicbrainz.org` and `spotify.com`. While these capabilities are aligned with the stated purpose of importing music metadata, the combination of credential handling, shell execution, and automated web interaction represents a significant attack surface without additional sandboxing.