lastfm

SUSPICIOUS. The skill’s stated purpose is coherent, but its trust model is weak: it requires a third-party `lastfm-cli` outside verified Last.fm ownership and forwards write-capable credentials through it. No explicit malicious behavior is shown, but install provenance and data-flow certainty are insufficient for a benign rating.