Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

Control Spotify On Headless Linux

BSecurity

Spotify CLI for headless Linux servers. Control Spotify playback via terminal using cookie auth (no OAuth callback needed). Perfect for remote servers without localhost access.

19 stars
0 votes
0 copies
1 views
Added 9/19/2026
ai-agentsgobashgitapisecurity

Works with

terminalcliapi

Security Analysis

B84/100
mediumUses curl or wget to download content
criticalModifies startup scripts or system services for persistence

Scanned 9/19/2026

Install to Claude Code

$npx -y skills add rondoflow/rondoflow --skill control-spotify-on-headless-linux --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Control Spotify On Headless Linux?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Control Spotify On Headless Linux
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/rondoflow-control-spotify-on-headless-linux/badge)](https://www.skillsdirectory.com/skills/rondoflow-control-spotify-on-headless-linux)

More formats (shields.io, HTML) on the badges page.

Download with Pro
Files
SKILL.md
---
name: control-spotify-on-headless-linux
description: "Spotify CLI for headless Linux servers. Control Spotify playback via terminal using cookie auth (no OAuth callback needed). Perfect for remote servers without localhost access."
category: "Media"
author: community
version: "1.2.0"
icon: image
---

# Spogo - Spotify CLI for Linux Servers

Control Spotify from headless Linux servers using cookie-based auth. No OAuth callback needed - perfect for remote servers.

## Why This Skill?

The original `spotify-player` skill by `steipete` on ClawHub assumes local browser access for cookie import (`spogo auth import --browser chrome`). On headless Linux servers without a local browser, this doesn't work.

This skill documents the cookie-based workaround - copy 2 browser cookies and you're done. No OAuth, no localhost needed.

## Requirements
- Spotify Premium account
- Go 1.21+ installed
- User's Spotify browser cookies

## Installation (Linux)

### 1. Install Go (if not installed)

```bash
# Ubuntu/Debian
sudo apt update && sudo apt install -y golang-go

# Or download latest from https://go.dev/dl/
wget https://go.dev/dl/go1.23.4.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.23.4.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:~/go/bin' >> ~/.bashrc
source ~/.bashrc
```

### 2. Install spogo

```bash
go install github.com/steipete/spogo/cmd/spogo@latest
```

This installs to `~/go/bin/spogo`. Add to PATH if needed:
```bash
echo 'export PATH=$PATH:~/go/bin' >> ~/.bashrc
source ~/.bashrc
```

### 3. Verify

```bash
spogo --version
# spogo v0.2.0
```

## Setup (Cookie Auth)

Since OAuth requires localhost callback (impossible on remote servers), we use cookie auth instead.

### 1. Get cookies from browser

Have the user open DevTools → Application → Cookies → `open.spotify.com` and copy:
- `sp_dc` - Main auth token (long string, required)
- `sp_t` - Device ID (UUID format, required for playback)

### 2. Create config

Create `~/.config/spogo/config.toml`:
```toml
default_profile = "default"

[profile.default]
cookie_path = "~/.config/spogo/cookies/default.json"
market = "IL"
language = "en"
```

### 3. Create cookies file

Create `~/.config/spogo/cookies/default.json`:
```json
[
  {
    "name": "sp_dc",
    "value": "USER_SP_DC_VALUE",
    "domain": ".spotify.com",
    "path": "/",
    "expires": "2027-01-01T00:00:00Z",
    "secure": true,
    "http_only": true
  },
  {
    "name": "sp_t",
    "value": "USER_SP_T_VALUE",
    "domain": ".spotify.com",
    "path": "/",
    "expires": "2027-01-01T00:00:00Z",
    "secure": false,
    "http_only": false
  }
]
```

### 4. Verify

```bash
spogo auth status
# → "Cookies: 2 (file)"
```

## Commands

```bash
# Search
spogo search track "query"
spogo search track "query" --json --limit 5

# Play
spogo play spotify:track:ID
spogo play                    # Resume
spogo pause
spogo next / spogo prev

# Devices
spogo device list --json
spogo device set "DEVICE_ID"

# Status
spogo status
spogo status --json
```

## "missing device id" Error - Browser Fallback

spogo needs an active Spotify session. If no device played recently, you can start one via the browser.

> **Note:** This is optional and only needed when `spogo device list` returns no active devices.
> It opens `open.spotify.com` in the agent's isolated browser profile (not the user's personal browser).
> The agent only navigates to Spotify and clicks Play — no other browser state is accessed.

1. **Open track in browser**:
```
browser open https://open.spotify.com/track/TRACK_ID profile=openclaw
```

2. **Click Play** via browser automation

3. **Transfer to target device**:
```bash
spogo device set "DEVICE_ID"
```

The Spotify session stays active for hours after playback.

## Rate Limits

- Connect API (default): No rate limits ✓
- Web API (`--engine web`): Rate limited (429 errors)
- For library access when rate limited → use browser automation

## Troubleshooting

### "missing device id"
No active Spotify session. Use browser fallback (see above) to start playback first.

### "401 Unauthorized"
Cookies expired. Get fresh cookies from browser and update the JSON file.

### Commands work but no sound
Check `spogo device list` - playback might be on wrong device. Use `spogo device set "DEVICE_ID"` to switch.

## Security & Privacy

- **Cookie handling**: `sp_dc` and `sp_t` are stored locally in `~/.config/spogo/cookies/` — treat them as secrets, never log or share them
- **Network access**: spogo only communicates with Spotify APIs (`api.spotify.com`, `open.spotify.com`)
- **Browser fallback**: Optional — only used when no active Spotify device exists. Uses the agent's browser profile to open `open.spotify.com` and click Play. This does NOT extract additional cookies or access other browser state
- **Install source**: `go install` from the official [steipete/spogo](https://github.com/steipete/spogo) GitHub repository — open source, auditable

## Notes

- **Cookie expiry**: ~1 year, but may invalidate if user logs out or changes password
- **Premium required**: Free accounts can't use Connect API
- **Market setting**: Change `market` in config for correct regional availability (IL, US, etc.)

Attribution

rondoflowrondoflow
View sourceMore from rondoflow →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Caveman

Ultra-compressed communication mode that cuts output tokens while keeping technical accuracy. Levels: lite, full, ultra and the wenyan variants. Use for /caveman, "caveman mode", "talk like caveman", "be brief" or "less tokens".

1074701 votes

Hyperplan

Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...

693621 votes

Mcp Code Execution

Routes multi-tool workflows through MCP servers for large datasets and pipelines. Use when Bash tool overhead is limiting throughput on data-heavy tasks.

3351 votes

catchup

Recovers the conversation and failed tool calls of a previous Codex, Claude Code, Antigravity, Cline, Copilot CLI, Cursor, DeepSeek Harness, Kimi, OpenCode, Pi Agent, or ZCode session. Use when the user says "catch up", "what did the last session do", "get me up to speed", "I switched agents", asks to recover/summarize a previous session before continuing, or asks to diagnose or report a catchup failure. Do NOT use for the current conversation, git history, or any non-agent log.

691 votes

math-skill

A comprehensive mathematical reasoning skill for AI assistants — handles arithmetic to research-level problems with rigorous step-by-step reasoning, systematic verification, and transparent uncertainty handling

381 votes
View all in ai-agents →