Blucli

BluOS CLI (blu) for discovery, playback, grouping, and volume.

Security Scan

The skill appears to do what it claims (control BluOS devices) and its install comes from a GitHub Go module, but there are small metadata inconsistencies and an undeclared environment variable reference that should be clarified before install.

Purpose & Capability

SKILL.md and metadata clearly target the 'blu' CLI (BluOS control) and the included install step installs that CLI via a Go module on GitHub — this matches the description. However, the registry metadata at the top of the report lists no required binaries or install spec while the SKILL.md declares 'bins:["blu"]' and an install entry; that mismatch is an internal inconsistency.

Instruction Scope

Runtime instructions are limited to invoking the 'blu' CLI for device discovery, playback, grouping, and volume. They do not request unrelated files or network endpoints. The SKILL.md does reference the BLU_DEVICE environment variable as a target-selection mechanism, but BLU_DEVICE is not declared in the skill's required env list — this should be declared or the instructions clarified.

Install Mechanism

The install instruction embedded in SKILL.md uses a Go module from github.com/steipete/blucli — a public GitHub path, which is a reasonable and expected source for a CLI. This is moderate risk (it will compile/run code from the repository). The registry-level metadata presented earlier claimed 'No install spec', so the presence of an install entry only in SKILL.md is an inconsistency to be aware of.

Credentials

No required secrets or high-privilege environment variables are declared. The only env var mentioned in the instructions is BLU_DEVICE (for selecting a target device), which is proportional to the skill's purpose but should be declared explicitly in requires.env so users know what the skill may read.

Persistence & Privilege

The skill does not request always:true and is user-invocable only; it does not request elevated or persistent platform privileges. Autonomous invocation is allowed (default), which is normal — no additional persistence or cross-skill config writes are indicated.

What to consider before installing

This skill appears to be a thin wrapper that expects the 'blu' CLI. Before installing, verify the GitHub repo (github.com/steipete/blucli) to ensure you trust the code you're allowing to be compiled/run. Ask the publisher to fix the metadata mismatch (the registry listing should declare the 'blu' binary and the Go install step), and to explicitly declare BLU_DEVICE in requires.env if the skill will read that environment variable. If you proceed, prefer installing the blu CLI yourself from the upstream repo (or inspect its source) rather than relying on an automatic install step.

blucli (blu)

Use blu to control Bluesound/NAD players.

Quick start

• blu devices (pick target)
• blu --device <id> status
• blu play|pause|stop
• blu volume set 15

Target selection (in priority order)

• --device <id|name|alias>
• BLU_DEVICE
• config default (if set)

Common tasks

• Grouping: blu group status|add|remove
• TuneIn search/play: blu tunein search "query", blu tunein play "query"

Prefer --json for scripts. Confirm the target device before changing playback.