spotify-mp3-cli-downloader

SUSPICIOUS. The stated purpose is coherent for a media downloader, but the install trust chain is not: users are directed to fetch and run an unverifiable external binary from a GitHub Pages site, then place it in PATH. The added request to export Spotify API credentials increases risk because those secrets may be forwarded to black-box third-party code.