Audit: restore or remove the missing lastfm-cli implementation #96

New issue

Closed

opened 2026-07-11 09:19:39 -04:00 by magnus · 0 comments

magnus commented

2026-07-11 09:19:39 -04:00

Owner

Finding

The lastfm skill presents itself as a working CLI wrapper, but its implementation is absent. lastfm/README.md lists scripts/lastfm-cli in What You Get, SKILL.md requires lastfm-cli to be on PATH and gives it as every command example, and scripts/test-lastfm.sh attempts to compile and execute it. The skill directory contains only SKILL.md, README.md, references/auth-flow.md, and the test script; there is no scripts/lastfm-cli.

The included test suite therefore fails 12 of 12 checks from the skill root because it hard-codes CLI=lastfm-cli, which is neither bundled nor installed.

Acceptance criteria

Add the documented scripts/lastfm-cli implementation and make the test invoke it relative to the skill directory, or explicitly redesign this as a reference-only skill and remove the false bundled-CLI claims.
Make test-lastfm.sh location-independent and runnable from the repository root.
Add a CI check that every script claimed in a README What You Get table exists and that its smoke test uses the bundled path.

## Finding The lastfm skill presents itself as a working CLI wrapper, but its implementation is absent. lastfm/README.md lists scripts/lastfm-cli in What You Get, SKILL.md requires lastfm-cli to be on PATH and gives it as every command example, and scripts/test-lastfm.sh attempts to compile and execute it. The skill directory contains only SKILL.md, README.md, references/auth-flow.md, and the test script; there is no scripts/lastfm-cli. The included test suite therefore fails 12 of 12 checks from the skill root because it hard-codes CLI=lastfm-cli, which is neither bundled nor installed. ## Acceptance criteria - Add the documented scripts/lastfm-cli implementation and make the test invoke it relative to the skill directory, or explicitly redesign this as a reference-only skill and remove the false bundled-CLI claims. - Make test-lastfm.sh location-independent and runnable from the repository root. - Add a CI check that every script claimed in a README What You Get table exists and that its smoke test uses the bundled path.

magnus referenced this issue from a pull request that will close it,

2026-07-11 09:25:27 -04:00

fix: resolve skill audit findings #97

magnus closed this issue

2026-07-11 09:25:53 -04:00