追剧/追番技能, 支持投屏到电视

The name/description (search streaming sources and cast to TVs) aligns with the runtime commands (mcporter/uvx calls and mitv/tvbox play commands). However the registry metadata does not declare the optional environment variables (MITV_LOCAL_IP, MITV_LIST_CFG, TVBOX_LOCAL_IP, TVBOX_LIST_CFG) that the SKILL.md explicitly requires for casting — this is an inconsistency the author should have declared.

SKILL.md tells the agent to run npx -y mcporter ... 'uvx mcp-vods' which will fetch and execute code from npm at runtime, and to send media URLs to local device IPs (Xiaomi / Android TV). That means the agent will: (a) download/execute code from the network each run, and (b) communicate with local network devices using addresses supplied via env vars. The instructions also reference env vars not present in the registry metadata.

There is no install spec; instead the skill relies on npx -y to fetch and execute mcporter/mcp-vods on demand. Using npx implies transient downloading and running of remote packages from the npm registry each time — this is higher risk than pure instruction-only behavior because arbitrary code will be executed at runtime.

Registry declares no required env vars, but SKILL.md expects MITV_LOCAL_IP / MITV_LIST_CFG and TVBOX_LOCAL_IP / TVBOX_LIST_CFG to enable casting. The skill accesses env vars that are not declared in the metadata (a mismatch). Those env vars control local network targets (TV IPs) — sensitive in that they enable contacting devices on the user's LAN.

always:false and no install-time persistence or modification of other skills is requested. The skill does not request permanent/system-level privileges in the metadata.