Security audit

arr CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only guide for querying self-hosted media services, with expected privacy considerations but no evidence of hidden or destructive behavior.

Install only if you operate or are authorized to inspect the target media stack. Treat `jellyfin now`, recent activity, request lists, debug output, and `--verbose` raw payloads as potentially private, and avoid logging or sharing them unintentionally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
Available on **all five CLIs**. Run `<cli> --help` for the per-service synopsis; universal flags are accepted by every subcommand, so position (before vs. after the subcommand) does not matter. | Flag | Default | Effect | | --------------------------- | -------------- | -------------------------------------------------------------------------------------------------- | | `--config PATH` | canonical path | Per-invocation config override. Works in either position (see _Flag ordering_). | | `--debug` / `--no-debug` | off | Full traceback + redacted request/response pair on stderr |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
`seerr` targets **Seer** (the unified Overseerr + Jellyseerr fork). | Command | Notes | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `seerr requests` | Renderer unwraps `{page, totalPages, totalResults, results}` envelope | | `seerr request-count` | Aggregate counts |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
| Command | Notes | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `seerr requests` | Renderer unwraps `{page, totalPages, totalResults, results}` envelope | | `seerr request-count` | Aggregate counts | | `seerr search <query>` | Percent-encoded; renderer unwraps paginated envelope. Multi-word / reserved-char queries short-circuit to `[]`. | | `seerr available <query>` | Client-side title-substring match after fetch | | `seerr trending [movie\|tv] [day\|week]` | Defaults `timeWindow=week`, no mediaType filter |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
| `seerr available <query>` | Client-side title-substring match after fetch | | `seerr trending [movie\|tv] [day\|week]` | Defaults `timeWindow=week`, no mediaType filter | | `seerr upcoming-movies` | Universal flags only (`--limit`, `--page`, `--language`) | | `seerr upcoming-tv` | Universal flags only | | `seerr discover-movies` | `--genre`, `--sort`, `--language`, `--page`; no defaults sent on the wire | | `seerr discover-tv` | `--genre`, `--sort`, `--language`, `--page`; no defaults sent on the wire | | `seerr movie <tmdbId> [--ratings]` | Adds RT critic + audience scores under `payload["ratings"]` |

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The jellyfin now command is described as returning "All active sessions across users," which can reveal other users' viewing activity. Although the file emphasizes read-only behavior, it does not explicitly warn that this output may contain sensitive user activity data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The --verbose description explicitly says it can return full raw payloads with server-internal metadata, but the documentation does not warn users that this may expose sensitive or personal data in terminals, logs, or downstream pipelines. This is a user-facing behavior with privacy implications and should be disclosed.
Content: No source excerpt is available for this finding.