Emby Tv Organizer

ReviewAudited by ClawScan on May 16, 2026.

Overview

This skill is mostly aligned with organizing Emby TV folders, but it should be reviewed because its helper script can automatically install an unpinned Python package and it performs persistent file moves/renames after approval.

Review the generated rename plan carefully before approving any file operations. If you use the Excel feature, be aware that the helper may install openpyxl automatically unless it is already present; prefer installing a pinned dependency yourself or asking the publisher to declare it properly.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Generating the Excel file may download and install code from the Python package ecosystem without a separate, explicit setup step or pinned version.

Why it was flagged

The helper script automatically installs an unpinned dependency at runtime, while the registry metadata declares no install spec or required binaries/dependencies.

Skill content

except ImportError:
    print("缺少 openpyxl，正在安装...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "openpyxl", "-q"])

Recommendation

Declare Python/openpyxl as an installation requirement, pin the dependency version, avoid runtime pip installs, and ask the user before installing anything.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the preview is wrong and the user confirms it, many media files could be renamed or moved incorrectly.

Why it was flagged

The skill is designed to perform bulk local file moves and renames, which is high-impact but appears purpose-aligned and guarded by preview/confirmation instructions.

Skill content

按对照表逐文件执行移动和重命名。 如果目标文件已存在，不覆盖，标记为「冲突」。

Recommendation

Carefully review the proposed rename table before confirming, especially season/episode detection and destination folders.

Low

#ASI05: Unexpected Code Execution

What this means

A crafted filename in the scanned folder could become an active Excel formula in the generated report.

Why it was flagged

Raw record values, including original paths and filenames, are written directly into Excel cells without formula escaping. Maliciously named local files could be interpreted as formulas when the spreadsheet is opened.

Skill content

row_data = [record.get(h, "") for h in HEADERS]
ws.append(row_data)

Recommendation

Escape cell values that begin with formula-triggering characters such as =, +, -, @, tab, or carriage return before writing them to .xlsx.