v1.0.2

追剧/追番技能, 支持投屏到电视

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:27 AM.

Analysis

This skill openly uses command-line MCP tooling to search video sources and optionally cast to a TV; the main things to notice are remote package execution and local TV control, both aligned with its stated purpose.

GuidanceThis appears coherent for a media search and TV-casting skill. Before installing, make sure you trust the upstream packages it runs through npx/uvx, and be careful when using the casting commands because they can start playback on a configured local TV.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

`npx -y mcporter call --stdio 'uvx mcp-vods' vods_search keyword="影视名称"`

The skill relies on externally resolved command-line packages via npx and uvx, with no pinned version or local reviewed code in the artifact. This is disclosed and central to the MCP-based media-search purpose, so it is a supply-chain note rather than a concern.

User impactWhen used, the agent may run externally sourced package code to provide the media search/casting tools.

RecommendationInstall only if you trust the referenced mcp-vods/mcporter packages and their source; consider pinning versions or reviewing the upstream repository before use.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

`mitv_play_media url="影视URL" addr="小米电视IP"` and `tvbox_play_media url="影视URL" addr="安卓电视IP"`

The skill exposes tools that can send a media URL to a local TV device. This is exactly the advertised casting feature, but it is still a user-visible action affecting another device.

User impactIf invoked with a TV address, the agent could start playback on that local TV.

RecommendationUse the casting feature only with TVs you own or control, and verify the media URL and target IP before asking the agent to play content.