skills/netease/skills/ncm-cli-setup/Gen Agent Trust Hub

ncm-cli-setup

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/install_mpv.py script executes shell commands to install the mpv player via standard package managers (brew, apt, dnf, pacman, winget, etc.). While it uses shell=True, the commands are hardcoded strings for well-known package managers and do not incorporate unvalidated user input. This is a standard installation pattern for this type of utility.- [EXTERNAL_DOWNLOADS]: The skill downloads the ncm-cli package from the official NPM registry and triggers system package managers (like Homebrew or APT) to download mpv. These are trusted sources and standard dependencies for the tool's functionality.- [PRIVILEGE_ESCALATION]: The installation script uses sudo for Linux package managers (apt, dnf, pacman, etc.) to install the mpv player. This is a common and expected requirement for system-level package installation on Linux.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 08:04 AM