Play audio/video locally on the host
Security Analysis
medium confidenceThe skill's requirements and instructions are broadly consistent with a local media player that uses mpv, with a small documentation/integration mismatch to review before installing.
The name/description (play audio/video locally) matches the declared requirement (mpv) and the install spec (dnf install mpv). Requesting mpv is appropriate for a local media player.
SKILL.md shows usage examples that call a 'media-player' CLI (media-player play/pause/stop), but the skill bundle contains no code that implements a 'media-player' wrapper — only a dependency on mpv. The instructions do not explicitly show how the agent should invoke mpv itself. This is a documentation/integration gap (not evidence of malicious behavior) but it could cause surprising behavior unless the agent platform provides that wrapper or the skill author supplies it at runtime.
Install uses the distro package manager (dnf) to install mpv, a normal and expected mechanism. The install target is a standard OS package (mpv), not an arbitrary external archive or URL. Note: dnf is specific to Fedora/RHEL-family systems; on other OSes the install step will be inapplicable.
The skill requests no environment variables, credentials, or config paths. That is proportionate for a local media player. Playing remote URLs implies network access but no secrets are required by the skill itself.
The skill does not request always:true, does not modify other skills/config, and has no special persistence demands. Installing mpv via dnf requires system privileges (sudo) which is normal for package installation.
Guidance
This skill is mostly coherent: it wants mpv and shows how to install it via dnf. Before installing, note two practical points: (1) SKILL.md examples call a 'media-player' command that is not included in the package — confirm whether your agent runtime provides that wrapper or whether the agent will invoke mpv directly. (2) Installing mpv requires sudo privileges and will add a system package (dnf is for Fedora/RHEL-like systems). The skill doesn't ask for secrets or system config access, but it will read/play local files you ask it to and can fetch remote URLs. If you only need local playback and trust the source, it's reasonable to install; if you require guarantees about what commands the agent runs, ask the skill author or inspect the runtime integration that implements the media-player CLI first.
Latest Release
v1.0.0
Initial publish
More by @Xejrax
Published by @Xejrax on ClawHub
