ncm-cli setup

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A global npm install can add executable code to the user's environment.

Why it was flagged

The skill asks the user to install a global npm package without a pinned version. This is central to the setup purpose, but users should verify the package identity and trust the upstream source.

Skill content

npm install -g @music163/ncm-cli

Recommendation

Verify that @music163/ncm-cli is the intended official package before installing, and prefer trusted package sources.

Note

ASI05: Unexpected Code Execution

What this means

Running the helper may install system packages and request elevated privileges.

Why it was flagged

The helper script runs shell package-manager commands, including sudo on Linux. The commands are fixed and purpose-aligned with installing mpv, but they modify the system.

Skill content

run("sudo apt-get update -q && sudo apt-get install -y mpv")

Recommendation

Run the installer only when you want mpv installed, and review any sudo/package-manager prompts before approving them.

Note

ASI03: Identity and Privilege Abuse

What this means

Your ncm-cli configuration may store API credentials and login state for the music service.

Why it was flagged

The skill instructs users to configure an API appId/privateKey and log in. This is expected for ncm-cli, but it involves account credentials even though the registry metadata lists no primary credential.

Skill content

ncm-cli config set appId <你的AppId>
ncm-cli config set privateKey <你的PrivateKey>
...
ncm-cli login --background

Recommendation

Use credentials intended for ncm-cli, avoid sharing the privateKey, and understand where ncm-cli stores its configuration.