追剧/追番技能, 支持投屏到电视

用于追剧/追番的技能，为AI提供搜索影视播放地址的能力，并支持在小米电视上直接播放。当用户想搜索影视、动漫、短剧、综艺等节目信息或更新进度时使用此技能。

This skill appears to do what it says (search streaming sources and cast to TVs) but there are a few risks and inconsistencies you should weigh: 1) Runtime code-fetch: the SKILL.md uses `npx -y mcporter` which will download and execute packages from npm each time the skill runs — only install/use this if you trust the mcporter/mcp-vods packages and their upstream authors. 2) Undeclared env vars: the doc requires MITV_LOCAL_IP / MITV_LIST_CFG and TVBOX_LOCAL_IP / TVBOX_LIST_CFG to perform casting, but those are not declared in the skill metadata; the author should add them so you can review and control what gets provided. 3) Local network access: casting requires contacting devices on your LAN using the provided IPs — avoid exposing sensitive devices and consider using a test network if unsure. 4) No code is packaged in the skill itself, so you should inspect the referenced GitHub repo and the npm packages (mcporter, uvx, mcp-vods) before using. If you decide to proceed: verify package provenance (npm author, GitHub repo contents), run in an isolated environment or container first, and only provide TV IPs you control.

Type: OpenClaw Skill Name: mcp-vods Version: 1.0.2 The skill is classified as suspicious due to its reliance on external package runners (`npx`, `uvx`) to execute `mcporter` and `mcp-vods` with user-controlled input (`keyword`, `url`, `addr`) as arguments, as seen in `SKILL.md`. This introduces significant supply chain risk, as the security of the skill depends entirely on the integrity of these external packages. Furthermore, the direct passing of user input to shell commands without explicit sanitization creates a potential command injection vulnerability if the underlying `mcporter` or `mcp-vods` implementations are not robust against such attacks.