whatisxlistening.to

Do not run or deploy this package blindly. Specific things to check before installing: - The registry metadata declares no required env vars, but the docs/code require LASTFM_API_KEY and LASTFM_USERNAME — ensure you supply only the minimal Last.fm credentials (and preferably create a scoped API key) and never reuse high-privilege secrets. - The repository bundles unrelated tooling (Find My automation, Hammerspoon HTTP API, brain-sync that touches your Obsidian vault, an auto-updater, and k8s manifests). If you only want the Last.fm dashboard, extract and audit only the `skills/whatisxlistening-to/` files rather than installing the whole workspace. - The docs include hardcoded infrastructure credentials (CouchDB admin user/password in brain-sync docs). Treat this as a secret leak: don't run any scripts that reference those endpoints until you confirm they are dummy/test values. Remove or rotate any leaked credentials you control. - Inspect server.py and lastfm_cli.py for outbound network calls and data handling (where data is sent, whether it logs or posts to external endpoints). Prefer running the server inside an isolated container or VM and bind it to localhost only. - Hammerspoon and findmy-location code can take screenshots and control the UI (click/type). Only run those on machines where you understand and accept that level of access; they require Accessibility and Screen Recording permissions on macOS. - Avoid enabling any auto-update/cron automation until you review the auto-updater logic; auto-updaters increase risk if the update source or update process is not strictly controlled. If you want help: I can (1) list the exact files that reference sensitive credentials, (2) summarize server.py's network behavior, or (3) produce a minimal checklist/command list to safely run the Last.fm parts inside a container.