Is jgm2025/devialet safe?
Yes. jgm2025/devialet is safe to install. Oathe's behavioral security audit gave the devialet skill by jgm2025 a trust score of 88/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/jgm2025/devialet
Is jgm2025/devialet safe to install?
This skill provides legitimate functionality for controlling Devialet speakers via HTTP API and Spotify integration. While it contains executable scripts and makes network requests, the code appears well-intentioned and follows standard patterns for device control and music service integration.
What security issues were found in jgm2025/devialet?
Category Scores
Findings (3)
MEDIUM Executable shell scripts with network access -25 ▶
The skill contains bash scripts that execute curl commands to make HTTP requests to user-specified IP addresses and external APIs. While the functionality appears legitimate for speaker control, executable code always presents some risk.
LOW External network communication -15 ▶
The skill communicates with external Spotify API endpoints and requires OAuth token storage. This is standard for music service integration but involves credential handling.
INFO Local network device communication -15 ▶
The skill is designed to communicate with Devialet speakers on the local network, which could theoretically be used for network discovery if the IP parameter is manipulated.
Should I install jgm2025/devialet?
Oathe's verdict for jgm2025/devialet is SAFE with a trust score of 88/100. Recommendation: Install.