Spotify Playlist Builder

Build and manage Spotify playlists from natural language requests. Search tracks/artists/albums, create playlists, manage tracks, view listening history. Use...

This skill appears to do what it says: it uses OAuth to access your Spotify account and stores the app credentials and tokens at ~/.openclaw/workspace/config/.spotify-tokens.json (file permission 600). Before installing or running: 1) only provide a client_id/client_secret from an app you created and trust; 2) be aware the secret and refresh/access tokens are stored locally (you can remove the file or revoke the app in your Spotify dashboard to cut access later); 3) the refresh flow prints tokens to stdout during refresh, so avoid running it in places where stdout is logged/shared; 4) if you don't want the agent to call this skill autonomously, disable skill invocation in your agent settings. If you want more assurance, inspect the files yourself or run the scripts in an isolated environment before granting real credentials.

Type: OpenClaw Skill Name: spotify-playlist Version: 1.0.0 The OpenClaw AgentSkills bundle for Spotify playlist management is benign. It correctly implements OAuth for Spotify, storing tokens securely within the designated OpenClaw workspace (`~/.openclaw/workspace/config/`). All network communication is directed to the official Spotify API endpoints. The `SKILL.md` provides clear, non-malicious instructions for the AI agent, focusing solely on playlist management and user listening history, without any prompt injection attempts to deviate from the stated purpose or perform unauthorized actions. The Python scripts (`auth.py`, `spotify.py`) use standard libraries and do not exhibit any signs of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.