Trust Assessment
spotify-web-api received a trust score of 92/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Unused Spotify Playlist Modification Scopes, Dependency Pinned with Minimum Version Only.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unused Spotify Playlist Modification Scopes The skill requests 'playlist-modify-public' and 'playlist-modify-private' Spotify API scopes, which grant permission to create, modify, and delete user playlists. However, the provided 'SKILL.md' description and the implemented Python commands ('now', 'recent', 'top', 'play', 'pause', 'next', 'prev', 'search', 'devices') do not include any functionality related to playlist management. Requesting these broad write permissions without a clear use case increases the attack surface if the skill or its environment were compromised. Remove 'playlist-modify-public' and 'playlist-modify-private' from the 'SCOPES' list if the skill does not intend to offer playlist modification functionality. Re-evaluate if 'playlist-read-private' is necessary if no playlist reading features are implemented. | LLM | scripts/spotify.py:26 | |
| LOW | Dependency Pinned with Minimum Version Only The 'spotipy' dependency is specified as 'spotipy>=2.23.0'. While this ensures a minimum version, it allows for any future version of 'spotipy' to be installed, including potentially breaking changes or new vulnerabilities introduced in later minor or patch releases. Pinning to an exact version (e.g., 'spotipy==2.23.0') or using a strict upper bound (e.g., 'spotipy<3.0,>=2.23.0') is generally recommended for better reproducibility and to mitigate risks from unexpected changes in newer versions. Pin the 'spotipy' dependency to an exact version (e.g., 'spotipy==2.23.0') or use a more restrictive version range (e.g., 'spotipy~=2.23.0' or 'spotipy<3.0,>=2.23.0') to ensure consistent behavior and reduce the risk of unexpected issues from future updates. | LLM | scripts/spotify.py:4 |
Scan History
Embed Code
[](https://skillshield.io/report/81da394d956e338c)
Powered by SkillShield