name: sonoscli description: Control Sonos speakers (discover/status/play/volume/group). homepage: https://sonoscli.sh metadata: {"clawdbot":{"emoji":"🔊","requires":{"bins":["sonos"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/sonoscli/cmd/sonos@latest","bins":["sonos"],"label":"Install sonoscli (go)"}]}}

Sonos CLI

Use sonos to control Sonos speakers on the local network.

Quick start

sonos discover
sonos status --name "Kitchen"
sonos play|pause|stop --name "Kitchen"
sonos volume set 15 --name "Kitchen"

Common tasks

Grouping: sonos group status|join|unjoin|party|solo
Favorites: sonos favorites list|open
Queue: sonos queue list|play|clear
Spotify search (via SMAPI): sonos smapi search --service "Spotify" --category tracks "query"

Notes

If SSDP fails, specify --ip <speaker-ip>.
Spotify Web API search is optional and requires SPOTIFY_CLIENT_ID/SECRET.

Security Scan

Status

suspicious

Open VirusTotal

OpenClaw

gpt-5-mini

suspicious

OpenClaw analysis

The skill's instructions match a Sonos CLI tool, but registry metadata omits the declared binary/install steps present in SKILL.md—this mismatch and the remote Go install warrant caution before installing or granting credentials.

Confidence: medium

VirusTotal

Type: OpenClaw Skill Name: sonoscli Version: 1.0.0 The skill bundle is benign. It installs the `sonoscli` tool from a public Go module (`github.com/steipete/sonoscli`) and provides instructions for controlling Sonos speakers. The `SKILL.md` mentions the optional requirement for `SPOTIFY_CLIENT_ID/SECRET` environment variables for Spotify search functionality, which is a standard practice for API integrations and does not indicate any attempt at credential exfiltration or prompt injection against the agent.

Sonoscli