ncm-cli-setup
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/install_mpv.pyscript executes shell commands to install thempvplayer via standard package managers (brew, apt, dnf, pacman, winget, etc.). While it usesshell=True, the commands are hardcoded strings for well-known package managers and do not incorporate unvalidated user input. This is a standard installation pattern for this type of utility.- [EXTERNAL_DOWNLOADS]: The skill downloads thencm-clipackage from the official NPM registry and triggers system package managers (like Homebrew or APT) to downloadmpv. These are trusted sources and standard dependencies for the tool's functionality.- [PRIVILEGE_ESCALATION]: The installation script usessudofor Linux package managers (apt, dnf, pacman, etc.) to install thempvplayer. This is a common and expected requirement for system-level package installation on Linux.
Audit Metadata