build-mcp-genmedia

The script is a build and configuration helper with no clear malicious behavior in the provided fragment. Its material security risks are supply-chain integrity and local filesystem trust: it downloads an unverified toolchain, builds unpinned latest source from GitHub, and installs the resulting binaries as MCP commands. Pinning repository/toolchain hashes, verifying checksums or signatures, and using isolated or protected temporary directories would reduce risk.