FD clawarr-suite

Comprehensive management for self-hosted media stacks (Sonarr, Radarr, Lidarr, Readarr, Prowlarr, Bazarr, Overseerr, Plex, Tautulli, SABnzbd, Recyclarr, Unpackerr, Notifiarr, Maintainerr, Kometa, FlareSolverr). Deep library exploration, analytics, dashboard generation, content management, request handling, subtitle management, indexer control, download monitoring, quality profile sync, library cleanup automation, notification routing, collection/overlay management, and media tracker integration (Trakt, Letterboxd, Simkl).

Not recommendedlow grade F

modbender/skill-library-mcp Agent Skills author: modbender MIT 36 files · 24 scripts body ≈ 6 264 tokens Open the sourcegithub.com↗ analyzed 2 d ago

Comprehensive management for self-hosted media stacks (Sonarr, Radarr, Lidarr, Readarr, Prowlarr, Bazarr, Overseerr, Plex, Tautulli, SABnzbd, Recyclarr…

As a process D 46/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions

Integration Docker Data and analyticstype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

27/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 68
Run on models: none yet

Process rating

46/100

Unfinished process

Result and completion w 14: 0
Inputs and preconditions w 11: 0
When it triggers w 12: 20

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

Dangerous commands medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

How to improve

Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 74

✓ No critical or high findings

Medium and low: 74

medium Exfiltration net-credential-use references/common-issues.md:54

Credential used in a network call (verify the destination is the intended service)
```
curl -H "X-Api-Key: $KEY" http://host:7878/api/v3/downloadclient | jq
```
medium Exfiltration net-credential-use references/common-issues.md:57

Credential used in a network call (verify the destination is the intended service)
```
curl -H "X-Api-Key: $KEY" http://host:7878/api/v3/queue | jq '.records[].outputPath'
```
medium Exfiltration net-credential-use references/common-issues.md:74

Credential used in a network call (verify the destination is the intended service)
```
curl -H "X-Api-Key: $KEY" http://host:7878/api/v3/downloadclient | jq
```
medium Dangerous commands cmd-privilege references/common-issues.md:99

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /path/to/downloads  # Match container user
```
medium Exfiltration net-credential-use references/common-issues.md:114

Credential used in a network call (verify the destination is the intended service)
```
curl -H "X-Api-Key: $KEY" http://host:7878/api/v3/queue | jq '.records[] | {title, status}'
```
medium Dangerous commands cmd-privilege references/common-issues.md:146

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /path/to/appdata/radarr
```
medium Exfiltration net-credential-use references/common-issues.md:227

Credential used in a network call (verify the destination is the intended service)
```
curl -H "X-Api-Key: $KEY" http://host:7878/api/v3/downloadclient | jq
```
medium Dangerous commands cmd-privilege references/common-issues.md:339

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /mnt/media
```
medium Dangerous commands cmd-privilege references/common-issues.md:340

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /mnt/downloads
```
medium Dangerous commands cmd-privilege references/common-issues.md:377

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /mnt/media
```
medium Dangerous commands cmd-privilege references/setup-guide.md:23

Privilege escalation / world-writable permissions
```
sudo sh get-docker.sh
```
medium Dangerous commands cmd-privilege references/setup-guide.md:188

Privilege escalation / world-writable permissions
```
sudo chown -R 1000:1000 /mnt/storage
```
medium Dangerous commands cmd-privilege references/setup-guide.md:189

Privilege escalation / world-writable permissions
```
sudo chmod -R 775 /mnt/storage
```
medium Dangerous commands cmd-privilege references/setup-guide.md:333

Privilege escalation / world-writable permissions
```
echo "deb https://radarr.servarr.com/apt/ubuntu focal main" | sudo tee /etc/apt/sources.list.d/radarr.list
```
medium Dangerous commands cmd-privilege references/setup-guide.md:349

Privilege escalation / world-writable permissions
```
echo "deb https://apt.sonarr.tv/ubuntu focal main" | sudo tee /etc/apt/sources.list.d/sonarr.list
```
medium Dangerous commands cmd-pipe-to-shell references/setup-guide.md:359

Downloads and executes remote code from an unrecognised host (pipe to shell) (the skill's own vendor host)
```
curl -s https://lidarr.audio/install.sh | sudo bash
```
vendor-host
medium Exfiltration net-credential-use scripts/analytics.sh:65

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-Plex-Token: ${PLEX_TOKEN}" -H "Accept: application/json" \
```
medium Exfiltration net-credential-use scripts/dashboard.sh:65

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-Api-Key: $key" "$url" 2>/dev/null || echo "{}"
```
medium Exfiltration net-credential-use scripts/diagnose.sh:133

Credential used in a network call (verify the destination is the intended service)
```
history=$(curl -sf -H "X-Api-Key: ${api_key}" \
```
medium Exfiltration net-credential-use scripts/indexers.sh:44

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-Api-Key: $PROWLARR_KEY" "$url"
```
medium Exfiltration net-credential-use scripts/indexers.sh:46

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X POST -H "X-Api-Key: $PROWLARR_KEY" -H "Content-Type: application/json" -d "$data" "$url"
```
medium Exfiltration net-credential-use scripts/kometa.sh:90

Credential used in a network call (verify the destination is the intended service)
```
sections=$(curl -sf -H "X-Plex-Token: ${PLEX_TOKEN}" \
```
medium Exfiltration net-credential-use scripts/kometa.sh:96

Credential used in a network call (verify the destination is the intended service)
```
cols=$(curl -sf -H "X-Plex-Token: ${PLEX_TOKEN}" \
```
medium Exfiltration net-credential-use scripts/manage.sh:72

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-Api-Key: $key" "$url"
```
medium Exfiltration net-credential-use scripts/manage.sh:74

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X POST -H "X-Api-Key: $key" -H "Content-Type: application/json" -d "$data" "$url"
```
medium Exfiltration net-credential-use scripts/manage.sh:76

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X DELETE -H "X-Api-Key: $key" "$url"
```
medium Exfiltration net-credential-use scripts/manage.sh:78

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X PUT -H "X-Api-Key: $key" -H "Content-Type: application/json" -d "$data" "$url"
```
medium Exfiltration net-credential-use scripts/requests.sh:46

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-Api-Key: $OVERSEERR_KEY" "$url"
```
medium Exfiltration net-credential-use scripts/requests.sh:48

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X POST -H "X-Api-Key: $OVERSEERR_KEY" -H "Content-Type: application/json" -d "$data" "$url"
```
medium Exfiltration net-credential-use scripts/search.sh:53

Credential used in a network call (verify the destination is the intended service)
```
results=$(curl -sf -H "X-Api-Key: ${RADARR_KEY}" \
```
medium Exfiltration net-credential-use scripts/search.sh:76

Credential used in a network call (verify the destination is the intended service)
```
results=$(curl -sf -H "X-Api-Key: ${SONARR_KEY}" \
```
medium Exfiltration net-credential-use scripts/search.sh:99

Credential used in a network call (verify the destination is the intended service)
```
results=$(curl -sf -H "X-Api-Key: ${LIDARR_KEY}" \
```
medium Exfiltration net-credential-use scripts/status.sh:56

Credential used in a network call (verify the destination is the intended service)
```
if ! response=$(curl -sf -H "${key_header}: ${api_key}" "$url" 2>&1); then
```
medium Exfiltration net-credential-use scripts/subtitles.sh:45

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -H "X-API-Key: $BAZARR_KEY" "$url"
```
medium Exfiltration net-credential-use scripts/subtitles.sh:47

Credential used in a network call (verify the destination is the intended service)
```
curl -sf -X POST -H "X-API-Key: $BAZARR_KEY" -H "Content-Type: application/json" -d "$data" "$url"
```
low Secrets in code secret-high-entropy-token references/setup-guide.md:332

High-entropy token-like string (may be an id, hash or a credential)
```
sudo apt-key adv --keyserver hkp://keys…:80 --recv-keys 0xA2…493
```
low Dangerous commands cmd-background-process references/setup-guide.md:340

Starts a background / autostarted process
```
sudo systemctl enable --now radarr
```
low Secrets in code secret-high-entropy-token references/setup-guide.md:348

High-entropy token-like string (may be an id, hash or a credential)
```
sudo apt-key adv --keyserver hkp://keys…:80 --recv-keys 0x20…BF8
```
low Dangerous commands cmd-background-process references/setup-guide.md:352

Starts a background / autostarted process
```
sudo systemctl enable --now sonarr
```
low Dangerous commands cmd-background-process references/setup-guide.md:360

Starts a background / autostarted process
```
sudo systemctl enable --now lidarr
```
low Dangerous commands cmd-background-process references/setup-guide.md:386

Starts a background / autostarted process
```
sudo systemctl enable --now prowlarr
```
low Dangerous commands cmd-cron-mention references/traktarr-retraktarr.md:315

Mentions editing / listing crontab
```
crontab -e
```
low Dangerous commands cmd-cron-mention references/traktarr-retraktarr.md:346

Mentions editing / listing crontab
```
crontab -e
```
low Dangerous commands cmd-cron-mention references/traktarr-retraktarr.md:651

Mentions editing / listing crontab
```
crontab -e
```
low Exfiltration exfil-secret-in-url scripts/analytics.sh:48

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
local url="http://${HOST}:8181/api/v2?apikey=…&cmd=…"
```
placeholder
low Exfiltration exfil-secret-in-url scripts/dashboard.sh:155

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
SABNZBD_QUEUE=$(curl -sf "http://${HOST}:38080/api?apikey=…&mode=queue&output=json" 2>/dev/null || echo '{}')
```
placeholder
low Exfiltration net-credential-use scripts/dashboard.sh:155

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
SABNZBD_QUEUE=$(curl -sf "http://${HOST}:38080/api?apikey=…&mode=queue&output=json" 2>/dev/null || echo '{}')
```
variable host
low Exfiltration exfil-secret-in-url scripts/dashboard.sh:166

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
TAUTULLI_ACTIVITY=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…" 2>/dev/null || echo '{}')
```
placeholder
low Exfiltration net-credential-use scripts/dashboard.sh:166

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
TAUTULLI_ACTIVITY=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…" 2>/dev/null || echo '{}')
```
variable host
low Exfiltration exfil-secret-in-url scripts/dashboard.sh:167

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
TAUTULLI_HISTORY=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&length=10" 2>/dev/null || echo '{}')
```
placeholder
low Exfiltration net-credential-use scripts/dashboard.sh:167

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
TAUTULLI_HISTORY=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&length=10" 2>/dev/null || echo '{}')
```
variable host
low Exfiltration exfil-secret-in-url scripts/dashboard.sh:168

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
TAUTULLI_PLAYS=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&time_range=30" 2>/dev/null | jq -r '.res…ata // []')
```
placeholder
low Exfiltration net-credential-use scripts/dashboard.sh:168

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
TAUTULLI_PLAYS=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&time_range=30" 2>/dev/null | jq -r '.res…ata // []')
```
variable host
low Exfiltration net-credential-use scripts/diagnose.sh:96

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
queue=$(curl -sf -H "X-Api-Key: ${api_key}" "http://${HOST}:${port}/api/v3/queue" 2>/dev/null || echo '{"records":[]}')
```
variable host
low Exfiltration net-credential-use scripts/diagnose.sh:162

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
folders=$(curl -sf -H "X-Api-Key: ${RADARR_KEY}" "http://${HOST}:7878/api/v3/rootfolder" 2>/dev/null || echo '[]')
```
variable host
low Exfiltration net-credential-use scripts/diagnose.sh:168

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
folders=$(curl -sf -H "X-Api-Key: ${SONARR_KEY}" "http://${HOST}:8989/api/v3/rootfolder" 2>/dev/null || echo '[]')
```
variable host
low Exfiltration exfil-secret-in-url scripts/downloads.sh:44

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
local url="http://${HOST}:38080/api?apikey=…&mode=…&output=json"
```
placeholder
low Exfiltration exfil-secret-in-url scripts/letterboxd.sh:48

Credential passed in a URL query string (normal for some APIs — verify the host is the intended service) (placeholder value)
```
history=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&length=10000&media_type=movie")
```
placeholder
low Exfiltration net-credential-use scripts/letterboxd.sh:48

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
history=$(curl -sf "http://${HOST}:8181/api/v2?apikey=…&cmd=…&length=10000&media_type=movie")
```
variable host
low Exfiltration net-credential-use scripts/letterboxd.sh:89

Credential used in a network call (verify the destination is the intended service) (destination host is a configured variable)
```
movies=$(curl -sf -H "X-Api-Key: $RADARR_KEY" "http://${HOST}:7878/api/v3/movie")
```
variable host

…and 14 more

Files scanned: 36. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning description-no-when description does not say WHEN to use the skill (no "use when")
warning body-long SKILL.md body ≈ 6264 tokens (recommended < 5000); move details to references/
note frontmatter-key unknown frontmatter key "homepage"

Process rating: all ten parameters 46/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
20When it triggers. No condition that starts the skill
30Running it twice. 7 mutating operations with no state check
50Failures and branches. 0 branches, has a failure section
60Tools and files. Uses tools (bash, web) that frontmatter does not declare
70Execution cost. Instruction body is 6264 tokens
85Steps. 141 steps, 1 vague phrases
100Consistency. Name and required fields are in place
100Progress reporting. Reports progress

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 13 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
+1No license
+2Single-language instructions
+3Description length 527: enough signal without eating the budget
+4Structure: 57 headings
+3Step-by-step instructions: 141 items
+4Has examples (59 code blocks)
+4Reference files are cited in the instructions (8 of 8)
+3All 24 scripts are documented

Quality base 70; lint remarks subtract, signals add up to 100. Result: 68.

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 36

README.md 8K
SKILL.md 26K
openclaw.plugin.json 0K
references/api-endpoints.md 12K
references/common-issues.md 13K
references/companion-services.md 8K
references/dashboard-templates.md 10K
references/prompts.md 7K
references/setup-guide.md 14K
references/tracker-apis.md 8K
references/traktarr-retraktarr.md 16K
scripts/analytics.sh 9K
scripts/dashboard.sh 44K
scripts/diagnose.sh 6K
scripts/discover.sh 2K
scripts/downloads.sh 6K
scripts/indexers.sh 6K
scripts/kometa.sh 6K
scripts/letterboxd.sh 10K
scripts/library.sh 15K
scripts/maintainerr.sh 5K
scripts/manage.sh 14K
scripts/notifiarr.sh 5K
scripts/prowlarr.sh 7K
scripts/queue.sh 2K
scripts/recyclarr.sh 4K
scripts/requests.sh 7K
scripts/search.sh 3K
scripts/setup.sh 9K
scripts/simkl.sh 10K
scripts/status.sh 4K
scripts/subtitles.sh 5K
scripts/trackers.sh 18K
scripts/trakt.sh 51K
scripts/unpackerr.sh 4K
ui/index.html 32K

Frontmatter

homepage: https://github.com/omiron33/clawarr-suite

metadata: {"openclaw":{"requires":{"bins":["bash","curl","jq","bc","sed"]},"security":{"networkScope":"local-lan-and-user-configur

Dates

In catalog since —

Updated in catalog 16 Jun 2026

First seen here 7 Sept 2026

Last analysis 11 Sept 2026, 17:36 UTC

Last seen in crawl 22 h ago

Score history

Date		Score	Safety	Qual.
7 Sept 2026	F	27	0	68

Similar skills

F clawarr-suite LeoYeAI/openclaw-master-skills
F clawarr-suite ClawHub