Sonoscli

Install command

go install github.com/steipete/sonoscli/cmd/sonos@latest

Runtime requirements

Runtime requirements🔊 ClawdisBinssonos

Security scan

Security ScanVirusTotalVirusTotalBenignView report →OpenClawOpenClawSuspiciousmedium confidenceThe skill's instructions match a Sonos CLI tool, but registry metadata omits the declared binary/install steps present in SKILL.md—this mismatch and the remote Go install warrant caution before installing or granting credentials.Details ▾!Purpose & CapabilityThe skill's stated purpose (control Sonos speakers) matches the SKILL.md instructions (invoke a local `sonos` CLI). However, the registry metadata at the top of the submission lists no required binaries or install spec, while the SKILL.md's embedded metadata declares a required 'sonos' binary and a Go install (github.com/steipete/sonoscli). That inconsistency between declared registry requirements and the runtime instructions is unexpected and should be clarified.✓Instruction ScopeSKILL.md instructs only to run the `sonos` CLI against devices on the local network (discover, status, play, volume, grouping). It references SSDP and an IP override and optionally the Spotify Web API credentials for Spotify search. Instructions do not ask the agent to read unrelated files or exfiltrate data to external endpoints beyond the Sonos/Spotify flows.ℹInstall MechanismThe SKILL.md metadata includes an install entry that uses the Go module github.com/steipete/sonoscli/cmd/sonos@latest to produce a 'sonos' binary. Installing code from a public GitHub Go module is common but non-trivial: it requires a Go toolchain and executes remote code (moderate risk). The install source (GitHub) is reasonable, but because the registry-level spec omitted this, confirm the exact install command and inspect the upstream repo before running.ℹCredentialsNo required environment variables are declared at the registry level, but SKILL.md notes optional SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET for Spotify searches. These optional variables are proportional to the described Spotify feature. Do not supply Spotify credentials unless you trust the upstream package.✓Persistence & PrivilegeThe skill does not request persistent/always-on installation and uses default autonomous invocation. It does not attempt to modify other skills or system-wide config in…