Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description (play audio/video locally) matches the declared requirement (mpv) and the install spec (dnf install mpv). Requesting mpv is appropriate for a local media player.
Instruction Scope
SKILL.md shows usage examples that call a 'media-player' CLI (media-player play/pause/stop), but the skill bundle contains no code that implements a 'media-player' wrapper — only a dependency on mpv. The instructions do not explicitly show how the agent should invoke mpv itself. This is a documentation/integration gap (not evidence of malicious behavior) but it could cause surprising behavior unless the agent platform provides that wrapper or the skill author supplies it at runtime.
Install Mechanism
Install uses the distro package manager (dnf) to install mpv, a normal and expected mechanism. The install target is a standard OS package (mpv), not an arbitrary external archive or URL. Note: dnf is specific to Fedora/RHEL-family systems; on other OSes the install step will be inapplicable.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate for a local media player. Playing remote URLs implies network access but no secrets are required by the skill itself.
Persistence & Privilege
The skill does not request always:true, does not modify other skills/config, and has no special persistence demands. Installing mpv via dnf requires system privileges (sudo) which is normal for package installation.
Assessment
This skill is mostly coherent: it wants mpv and shows how to install it via dnf. Before installing, note two practical points: (1) SKILL.md examples call a 'media-player' command that is not included in the package — confirm whether your agent runtime provides that wrapper or whether the agent will invoke mpv directly. (2) Installing mpv requires sudo privileges and will add a system package (dnf is for Fedora/RHEL-like systems). The skill doesn't ask for secrets or system config access, but it will read/play local files you ask it to and can fetch remote URLs. If you only need local playback and trust the source, it's reasonable to install; if you require guarantees about what commands the agent runs, ask the skill author or inspect the runtime integration that implements the media-player CLI first.Like a lobster shell, security has layers — review code before you run it.
latestvk97eey463anr7gvefjn8g1sqns80edx7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎵 Clawdis
Binsmpv