Spotify Controller

Control Spotify playback and devices from an AI agent using spotify.py and the official Spotify Web API. Use when users ask to check current track, play/paus...

This skill appears coherent and implements only Spotify API calls. Before installing: (1) verify the skill source you obtained it from and inspect scripts/spotify.py yourself (it is included and readable), (2) do not commit SPOTIFY_* values into version control — store them in a secure secrets store or .env excluded from git, (3) generate the refresh token locally and only supply the long-lived refresh token to the runtime you trust, (4) limit the Spotify app scopes to the least privileges needed (playback control and read state), and (5) confirm the 'uv pip install' lines are applicable to your environment (use plain 'pip install requests' if unsure). If you do not want the agent to control playback autonomously, avoid enabling autonomous invocation or restrict when the skill can be called.

Type: OpenClaw Skill Name: spotify-controller Version: 1.0.1 The OpenClaw Spotify Controller skill is benign. Both the `SKILL.md` documentation and the `scripts/spotify.py` code are transparent and align with the stated purpose of controlling Spotify playback via its official Web API. The Python script securely handles Spotify API credentials from environment variables, uses the `requests` library for HTTP communication exclusively with `accounts.spotify.com` and `api.spotify.com`, and properly sanitizes user input for search queries using `urllib.parse.quote`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent. The setup instructions are standard for OAuth 2.0 and Python dependency management.