netease-music-cli

使用 ncm-cli 操作网易云音乐。当用户想播放歌曲、搜索歌曲、控制播放（暂停、下一首、上一首、调音量）、管理播放队列、查看播放状态、播放歌单时，使用此 skill。

Before installing: 1) Understand that this skill expects you to have the ncm-cli binary (and optionally mpv) already installed — but the skill metadata does not declare those requirements. Verify where ncm-cli comes from and that you trust that project. 2) The instructions ask you to configure an appId and privateKey (NetEase API keys). Decide where you will store those credentials (prefer ncm-cli's own secure config rather than exposing them to the agent environment) and confirm the CLI's behavior when it uses them. 3) The skill requires the agent to include a summary of recent conversation input in a --userInput parameter for many commands — this will send your conversation content to the CLI and (through it) to NetEase's APIs; avoid including sensitive personal data in those conversations. 4) The skill refers to a separate ncm-cli-setup skill to install the CLI — verify that setup skill before running it. 5) If you need higher assurance, ask the publisher to update the metadata to list required binaries and env vars, or request an explicit install spec and a link to the official ncm-cli repository so you can verify source code and network behavior.

Type: OpenClaw Skill Name: netease-music-cli Version: 1.0.1 The skill bundle for 'netease-music-cli' is classified as suspicious due to a high risk of shell injection. In SKILL.md (Step 6), the instructions mandate that the agent append a summary of the user's session to CLI commands via a '--userInput' flag. This pattern of passing user-derived strings directly into shell commands is a significant vulnerability if the underlying 'ncm-cli' tool lacks robust input sanitization. Furthermore, the skill requires users to provide sensitive NetEase Music API credentials (appId and privateKey), which could be compromised if the injection vulnerability is exploited.