1lou Search
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill’s search-and-download flow matches its description, but it embeds qBittorrent login credentials and can add torrents to a local NAS, so it needs review before use.
Install only if you own and intend to use the listed qBittorrent/NAS environment. Before use, remove and rotate the embedded password, replace it with your own scoped secret, verify each torrent before adding it, and periodically review or clear the watchlist file.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone or any agent using this skill may be able to access the configured qBittorrent instance and add downloads to the NAS paths listed in the skill.
The skill embeds a reusable qBittorrent endpoint, username, and password directly in the instructions, allowing the agent to authenticate to a local download service instead of using user-provided scoped secrets.
qBittorrent地址：192.168.1.38:8085; 账号：boring737; 密码：[hardcoded password]
Remove the embedded password, rotate the exposed credential, use a secret manager or environment variable, and restrict the qBittorrent account to the minimum permissions needed.
A mistaken selection or wrong torrent file could consume NAS storage or add unwanted downloads.
The skill instructs the agent to fetch torrent files and call qBittorrent’s API to add them. This is central to the stated purpose and includes user confirmation, but it still changes the user’s download environment.
等待用户确认下载哪个资源 ... curl -sL -o /tmp/xxx.torrent ... /api/v2/torrents/add
Keep the user-confirmation step, verify the torrent file and save path before adding it, and avoid letting the agent run these commands without explicit approval.
Search history and tracking preferences may remain on disk and influence future searches.
The skill stores search keywords in a persistent watchlist and reuses them for later tracking, creating persistent agent context.
追剧清单：/Users/bluepop/.openclaw/scripts/drama_watchlist.json ... 后续自动追剧时使用该关键字搜索
Make the watchlist opt-in, review or delete it when no longer needed, and require confirmation before any future automatic tracking or downloads.