Free Resource

This skill appears to implement what it claims, but there are two practical inconsistencies you should confirm before installing or running it: - Runtime requirement: The scripts use the Bun runtime (#!/usr/bin/env bun and bun ./scripts/...). The package metadata does not declare Bun as a required binary. Install Bun or run equivalent Node/ts tooling only after verifying compatibility. - Credentials & config: The metadata lists no required env vars, but the SKILL.md and scripts expect three API credentials (PIXABAY_API_KEY, FREESOUND_API_TOKEN, JAMENDO_CLIENT_ID) or a local config.json. Do NOT store API keys in a repo or commit config.json. Prefer setting environment variables and verify the source of the skill and trustworthiness of the author before providing keys. Additional suggestions: - Review the included TypeScript sources (they are present and readable) to confirm no hidden/obfuscated network endpoints; the code only references the official API base URLs. - Run the scripts in a sandboxed environment or container first, and avoid providing high-privilege or long-lived credentials until you're comfortable. - If you plan to use this as an automated/always-invoked skill, ensure the platform's autonomous invocation and network policies are acceptable — autonomous access combined with credentials increases risk. If you want, I can extract the exact lines where env vars/config are read and where Bun is required so you can audit them quickly.