controlling-spotify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited controlling-spotify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Control Spotify playback, search for music, and manage playlists using the Spotify MCP Server with full user account access.
Invoke this skill when users request:
CRITICAL: This skill requires user-provided credentials. The user must complete a one-time setup:
http://127.0.0.1:8888/callbackreferences/setup-guide.md)SPOTIFY_CLIENT_ID: From Spotify Developer DashboardSPOTIFY_CLIENT_SECRET: From Spotify Developer DashboardSPOTIFY_REFRESH_TOKEN: From helper script outputAlternative: Credentials can also be provided via a Project Knowledge file. Ensure the file contains a .env style block with the keys above.
Without these credentials, the skill cannot function. If credentials are missing, guide the user through the setup process detailed in references/setup-guide.md.
The Spotify MCP Server must be installed in the compute environment. Use the provided installation script which handles cloning, patching, and building the server.
# Run the installation script
bash scripts/install-mcp-server.shConfigure the MCP client to connect to the Spotify MCP server. Note the logic to support credentials from Project Knowledge.
from mcp import Client
import asyncio
import re
# 1. Try to get credentials from skill configuration
env_vars = {
"SPOTIFY_CLIENT_ID": credentials.get("SPOTIFY_CLIENT_ID"),
"SPOTIFY_CLIENT_SECRET": credentials.get("SPOTIFY_CLIENT_SECRET"),
"SPOTIFY_REFRESH_TOKEN": credentials.get("SPOTIFY_REFRESH_TOKEN")
}
# 2. If missing, look in Project Knowledge / Context for .env style block
if not all(env_vars.values()):
# Heuristic: Scan context/files for VAR=VALUE patterns
# (Pseudo-code: Implement based on available context access)
pass
# Server configuration
mcp_config = {
"command": "node",
"args": ["/home/claude/spotify-mcp-server/build/index.js"],
"env": env_vars
}
# Initialize client
async def initialize_spotify_mcp():
client = Client()
await client.connect_stdio(
mcp_config["command"],
mcp_config["args"],
mcp_config["env"]
)
return client result = await client.call_tool("searchSpotify", {
"query": "bohemian rhapsody",
"type": "track",
"limit": 10
}) result = await client.call_tool("getNowPlaying", {}) result = await client.call_tool("getMyPlaylists", {
"limit": 20,
"offset": 0
}) result = await client.call_tool("getPlaylistTracks", {
"playlistId": "37i9dQZEVXcJZyENOWUFo7"
}) result = await client.call_tool("getRecentlyPlayed", {
"limit": 10
}) result = await client.call_tool("getUsersSavedTracks", {
"limit": 50,
"offset": 0
}) # Play by URI
result = await client.call_tool("playMusic", {
"uri": "spotify:track:6rqhFgbbKwnb9MLmUQDhG6"
})
# Or by type and ID
result = await client.call_tool("playMusic", {
"type": "track",
"id": "6rqhFgbbKwnb9MLmUQDhG6"
}) result = await client.call_tool("pausePlayback", {}) result = await client.call_tool("skipToNext", {}) result = await client.call_tool("skipToPrevious", {}) result = await client.call_tool("addToQueue", {
"uri": "spotify:track:6rqhFgbbKwnb9MLmUQDhG6"
}) result = await client.call_tool("createPlaylist", {
"name": "My Workout Mix",
"description": "High energy tracks",
"public": False
}) result = await client.call_tool("addTracksToPlaylist", {
"playlistId": "3cEYpjA9oz9GiPac4AsH4n",
"trackUris": [
"spotify:track:4iV5W9uYEdYUVa79Axb7Rh",
"spotify:track:6rqhFgbbKwnb9MLmUQDhG6"
]
}) result = await client.call_tool("getAlbums", {
"albumIds": ["4aawyAB9vmqN3uQ7FjRGTy"]
}) result = await client.call_tool("getAlbumTracks", {
"albumId": "4aawyAB9vmqN3uQ7FjRGTy"
}) result = await client.call_tool("saveOrRemoveAlbumForUser", {
"albumIds": ["4aawyAB9vmqN3uQ7FjRGTy"],
"action": "save"
})# 1. Search for the song
search_result = await client.call_tool("searchSpotify", {
"query": "user's favorite song name",
"type": "track",
"limit": 1
})
# 2. Extract track URI from results
track_uri = search_result["tracks"][0]["uri"]
# 3. Play the track
await client.call_tool("playMusic", {
"uri": track_uri
})# 1. Search for tracks in genre
search_result = await client.call_tool("searchSpotify", {
"query": "genre:rock year:2020-2024",
"type": "track",
"limit": 20
})
# 2. Create new playlist
playlist_result = await client.call_tool("createPlaylist", {
"name": "Modern Rock Mix",
"description": "Recent rock tracks",
"public": False
})
# 3. Extract track URIs
track_uris = [track["uri"] for track in search_result["tracks"]]
# 4. Add tracks to playlist
await client.call_tool("addTracksToPlaylist", {
"playlistId": playlist_result["id"],
"trackUris": track_uris
})# Get current playback state
now_playing = await client.call_tool("getNowPlaying", {})
# Format and display
print(f"Now Playing: {now_playing['track']['name']}")
print(f"Artist: {now_playing['track']['artists'][0]['name']}")
print(f"Album: {now_playing['track']['album']['name']}")
print(f"Progress: {now_playing['progress_ms']} / {now_playing['duration_ms']} ms")Playback control operations (play, pause, skip, queue) require Spotify Premium. Read operations (search, get playlists, view tracks) work with free accounts.
For playback commands to work, the user must have an active Spotify session (web player, desktop app, mobile app) with a device available. If no active device, playback commands will fail.
Spotify API has rate limits (typically 180 requests per minute). For bulk operations, implement appropriate delays or batching.
Spotify uses URIs in the format:
spotify:track:IDspotify:album:IDspotify:artist:IDspotify:playlist:IDMost tools accept either URIs or separate type + id parameters.
Cause: Missing environment variables
Solution: Verify credentials are properly configured:
import os
print(os.getenv("SPOTIFY_CLIENT_ID")) # Should not be None
print(os.getenv("SPOTIFY_CLIENT_SECRET")) # Should not be None
print(os.getenv("SPOTIFY_REFRESH_TOKEN")) # Should not be NoneCause: No Spotify client is currently running/active
Solution: Guide user to:
Cause: User has Spotify Free account
Solution: Playback control requires Spotify Premium. Only search and read operations available for free accounts.
Cause: Missing dependencies or incorrect installation
Solution:
# Re-run installation script
bash scripts/install-mcp-server.shgetNowPlaying to verify device availabilityreferences/setup-guide.mdThis skill requires sensitive credentials. Ensure:
See references/setup-guide.md for detailed security best practices.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.