Security checks across malware telemetry and agentic risk
ClawTV is a transparent Apple TV automation skill, but it needs review because it stores media-control credentials locally and uses broad macOS automation with a real script-injection weakness.
Install only if you are comfortable giving this script control of your Apple TV and optional Plex server, and with AI mode sending TV screenshots and goals to Anthropic. Use a budget-limited Anthropic key, avoid AI mode on account or billing screens, delete old screenshots, manually restrict ~/.clawtv/config.json permissions, and be cautious pairing with devices whose names you do not control.
end tell
return false
'''
result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True)
if result.returncode != 0:
print(f"QuickTime setup failed: {result.stderr}")
return Falsepyatv>=0.15.0 anthropic>=0.40.0 plexapi>=4.15.0 pyobjc-framework-Quartz>=10.0 # optional: QuickTime screenshot method
pyatv>=0.15.0 anthropic>=0.40.0 plexapi>=4.15.0 pyobjc-framework-Quartz>=10.0 # optional: QuickTime screenshot method
pyatv>=0.15.0 anthropic>=0.40.0 plexapi>=4.15.0 pyobjc-framework-Quartz>=10.0 # optional: QuickTime screenshot method
66/66 vendors flagged this skill as clean.