polyv-live-cli

This skill is internally consistent: it documents a CLI for Polyv live-management and tells the agent how to use it. Before installing/using it, consider the following: - The runtime instructions run 'npx polyv-live-cli@latest', which will fetch and execute code from npm (@latest) on demand. Fetching and running unreviewed remote packages is a security risk. Prefer to audit the npm package (check publisher, package page, repository, recent versions) before allowing execution. - The skill’s metadata lacks a homepage/source; that increases risk. If you need this functionality, prefer obtaining the official polyv-live-cli package from a verified source, pin a specific version (not @latest), or install it yourself and run locally. - The agent will ask for AppID/AppSecret (or accept env vars). Never paste high-privilege credentials into an agent you don't fully trust. If possible, use a scoped/test account with limited permissions, or supply credentials via secure CI secrets or an audited config file under your control. - If you allow the agent to run these commands, monitor the credential storage location (~/.npx polyv-live-cli@latest/ per docs) and rotate keys if you later suspect misuse. If you want, I can: (1) look up the npm package page and repository (if you provide the package name/URL), (2) produce a checklist of steps to safely run these commands locally instead of letting the agent run them, or (3) suggest safer alternatives (pinning version, manual install, running in isolated environment).