In your case, spawn is most probably a command of expect scripting language which allows automation of interactive program operations. In such a case, spawn runs an external command from the expect script. Your script example is missing a shebang sequence (first line starting with #!), indicating the expect interpreter, and, as such, will not be interpreted by expect when executed directly.
Password authentication with sftp is limited to the interactive mode; To control sftp in interactive mode, you can use the following expect script example:
#!/usr/bin/env expect
set timeout 20 # max. 20 seconds waiting for the server response
set user username
set pass your-pass
set host the-host-address
set dir server-dir
spawn sftp $user@$host
expect assword:
send "$pass\r"
expect sftp>
send "cd $dir\r"
expect sftp>
send "mget *\r"
expect sftp>
send "exit\r"
expect eof
Another possibility is to use public-key authentication, which is more secure (see Setup SFTP to Use Public-Key Authentication). In such a case, you can simply use sftp directly in batch mode:
#!/bin/sh
user=username
host=the-host-address
dir=server-dir
sftp -b - "$user@$host" <<+++EOF+++
cd "$dir"
mget *
exit
+++EOF+++