x-cmd

Load x-cmd first: `. ~/.x-cmd.root/X`, then explore with `x nihao --llmstxt` or discover skills via `x skill`. x-cmd provides 600+ portable software and deve...

Security Scan

The skill's files and instructions are internally consistent with a user-local portable package manager, but it relies on downloading and executing remote install scripts (including a curl | sh option) which carries documented supply-chain risk — prefer the Homebrew path or manual review.

Purpose & Capability

Name/description (x-cmd as a portable tool/package manager) match the SKILL.md and install guide. The skill does not request unrelated credentials or files and the commands it describes (sourcing ~/.x-cmd.root/X, running `x env use ...`, `x skill`) are consistent with that purpose.

Instruction Scope

SKILL.md itself is focused on using the x-cmd loader and available packages. The included install.md expands runtime guidance and explicitly instructs downloading and executing remote install scripts. It also documents agent behavior (check for installation, ask user before installing, prefer safe methods). This is reasonable, but the instructions do present pathways (auto-install via curl | sh) that execute remote code without prior user review — a high-risk action that the document does warn about.

Install Mechanism

There is no bundled code, but the install guide lists three install mechanisms: Homebrew (low risk), manual download-then-review (medium), and a one-liner curl -fsSL https://get.x-cmd.com | sh (high risk). The get.x-cmd.com endpoint is a custom domain; auto-install executes remote code before checksum verification. These facts raise supply-chain and execution risk even though the guide correctly labels the risks and recommends safer options.

Credentials

The skill does not request any environment variables, credentials, or privileged config paths. All installation and runtime actions are described as user-local (~/.x-cmd.root/) with no sudo required, which is proportionate to a user-space package manager.

Persistence & Privilege

The skill is not marked always:true and does not request elevated persistent system privileges. Installation is user-local and removal instructions are provided. The skill does not attempt to modify other skills or system-wide agent settings.

Assessment

This skill appears to be what it says (a user-local portable package manager) and documents safer and riskier install options. Before installing: prefer the Homebrew bottle if available; if you must run a script from get.x-cmd.com, download it first and inspect it (do not pipe to sh). Do not use auto-install in environments that contain secrets or long-lived credentials. Verify SHA256 checksums for downloaded binaries and prefer Homebrew or manual review for production systems. If you allow an agent to install on your behalf, require explicit consent and specify the install method. If you decide not to install, the SKILL.md is otherwise safe to read — but avoid running unreviewed remote installers.

Load x-cmd first: . ~/.x-cmd.root/X, then explore with x nihao --llmstxt or discover skills via x skill.

---

Not installed? → data/install.md

---

Run x skill to browse 200+ skills

x skill

---

Visit x-cmd.com/llms.txt for more skill and power tools.

Entrance for AI agents.

---

Run x env use <pkg> to install any package instantly

Command	Purpose
x env la	List 600+ available software
x env la --json	JSON output for scripting
x env use <pkg>	Install and use a package (downloads to x-cmd local bin)
x pixi use <pkg>	Install package via pixi (downloads to pixi local bin)
x pixi search <keyword>	Search pixi packages
x nihao --llmstxt	View llms.txt

---

Try now: x env use jq nodejs python3

# Install and use tools
x env use jq
x env use nodejs
x env use python3

# After installation, use directly
jq '.' file.json
python3 -c "print(2+2)"

# Pixi for additional packages
x pixi use cowsay
x pixi search yml

---

Access 600+ tools: languages, editors, dev tools, databases

Languages & Runtimes: nodejs, python, rust, go, java, deno, bun, ruby, php

Editors: nvim, helix, emacs, vim

Dev Tools: git, gh, glab, fzf, ripgrep, fd, bat, exa, zoxide

Data: jq, yq, fx, csvkit, ffmpeg, imagemagick

System: htop, btop, procs, direnv, tmux

Databases: redis, sqlite, postgresql, mysql

Full list: x env la

---

Zero setup required: no sudo, auto PATH, isolated

• No sudo required - Packages installed to user-local directories
• PATH automatically configured by . ~/.x-cmd.root/X startup script
• Isolated environments - No version conflicts
• 600+ tools available

---

More: https://x-cmd.com/llms.txt

Entrance for AI agents.