TorrentClaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:50 PM UTC
• Version: 0.1.17

Overview

The skill mostly matches its torrent search/download purpose, but it deserves review because it can initiate local torrent downloads, sends sensitive torrent activity data to TorrentClaw, and documents an unpinned executable MCP install path.

Install only if you are comfortable with TorrentClaw receiving your torrent searches and selected torrent actions. Require the agent to ask before adding any magnet link, downloading any .torrent file, or starting aria2/Transmission. Avoid the unpinned `npx @torrentclaw/mcp` command unless you pin and review the package version first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:240
• Finding: Unpinned Third-Party Package Retrieval and Execution via npx## Vulnerability Details **File Locations**: `SKILL.md:240-252`; `README.md:11` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable code in `SKILL.md:240-252`:** ```markdown ## MCP Server Integration For users of **Claude Desktop**, **Cursor**, or **Windsurf**, TorrentClaw is also available as an MCP (Model Context Protocol) server: ```bash npx @torrentclaw/mcp ``` **MCP vs Skill:** - **Skill (this file)**: For OpenClaw, Claude Code, Cline, Roo Code — natural language interface - **MCP Server**: For Claude Desktop, Cursor, Windsurf — structured tools interface - **Both** use the same TorrentClaw API backend See https://torrentclaw.com/mcp for MCP installation and usage. ``` **Vulnerable code in `README.md:11`:** ```markdown **Alternative:** For Claude Desktop, Cursor, or Windsurf, use the [MCP Server](https://torrentclaw.com/mcp) instead (`npx @torrentclaw/mcp`). ``` ### Technical Analysis The documentation recommends running `npx @torrentclaw/mcp` without an exact package version, integrity constraint, lockfile, or locally reviewed package artifact. If the package is not already available locally, `npx` can resolve it from the configured npm registry, download it, and execute its code immediately. Because package resolution is not pinned, the effective code executed by this command may change after the Skill itself has been audited. The repository under review does not contain the MCP package implementation, so the behavior of the downloaded component cannot be verified from the audited project. This creates a supply-chain trust boundary in which a compromised publisher account, malicious future release, registry compromise, or altered registry configuration could cause arbitrary third-party code to run. Package installation and execution may also trigger lifecycle scripts supplied by the downloaded dependency. ### Attack Path 1. An attacker compr ...[truncated 1384 chars]
• Remediation: ## Remediation Suggestions 1. Replace the floating package reference with an exact, reviewed version, such as: ```bash npx --yes @torrentclaw/mcp@0.1.17 ``` The actual pinned version should be one that maintainers have explicitly audited. 2. Document the expected npm registry and provide package integrity or provenance verification instructions. Where supported, publish signed provenance and require users to verify it. 3. Prefer installing the package as a locked local dependency rather than downloading and executing it on demand: ```bash npm install --save-exact @torrentclaw/mcp@0.1.17 ``` Commit and review the resulting lockfile, then invoke the locked local binary. 4. Review package lifecycle scripts and the complete transitive dependency tree before recommending the package. 5. Keep the pinned version synchronized in both `SKILL.md` and `README.md` so users are not directed to a mutable latest release. 6. Add automated documentation checks that reject unversioned `npx` commands and other package-manager commands that immediately execute floating dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a broad end-to-end torrent search and retrieval capability centered on TorrentClaw, including remote API interaction, metadata retrieval, filtering, scoring, and result presentation. The actual code chunk does none of that. It only implements the narrow downstream action of adding an already-supplied magnet link to Transmission or aria2, with client autodetection and optional download directory handling. While that behavior is one small subset of the declared download flow, the primary purpose of the provided code is materially different from the declared overall skill behavior, and it uses local system resources/localhost RPC rather than any TorrentClaw API. Therefore this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description describes a full torrent discovery and download integration with TorrentClaw, including search, filtering, authentication, scoring, and interaction with local torrent clients. The supplied code does none of that. It only inspects the OS type and echoes human-readable installation instructions for Transmission or aria2. While the script is loosely related to torrent clients, its primary purpose is installation guidance, not torrent search/download or client control. This is a clear material mismatch between declared purpose and actual behavior.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill description markets search and download capability but does not clearly warn that it may automatically add magnet links to a detected local torrent client. In context, this is more dangerous because the skill targets torrent acquisition and can trigger local download activity with legal, bandwidth, storage, and user-safety consequences if actions occur without explicit informed consent.

Chaining Abuse

High

• Category: Tool Misuse

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to run `npx @torrentclaw/mcp` without pinning a specific version, which causes execution of whatever package version is current at install time. That creates a supply-chain risk: a compromised or newly published version could run arbitrary code on the user's machine, and the risk is elevated because this is an executable install path, not just a documentation link.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README advertises direct addition of magnet links to detected torrent clients and `.torrent` downloads without prominently warning about the side effects of initiating downloads, interacting with local applications, and potential legal/privacy consequences. In a torrent-focused skill, this omission is especially risky because users may not realize that seemingly simple search requests can transition into actions affecting their system and network activity.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The natural-language examples are broad enough that ordinary conversational requests like 'Find me Inception in the best quality' may trigger the skill unintentionally. In this skill's context, unintended activation is more dangerous than usual because activation can lead to searching torrent sources, detecting local clients, and progressing toward download-related actions with legal, privacy, and system side effects.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs the agent to execute shell commands and local scripts, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization gap where users and hosting platforms may not be adequately warned that the skill can invoke local shell access and modify the system by launching scripts or adding torrents to local clients.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill tells the agent to send user queries with an analytics header and later call a tracking endpoint after torrent selection, but the description does not warn users that their search terms and interaction events may be transmitted to a third-party service. Because the skill concerns potentially sensitive media interests and torrent activity, undisclosed telemetry increases privacy risk and may expose legally sensitive behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Important:** Always use `--data-urlencode` for user-supplied values to prevent shell injection. Never interpolate user input directly into the URL string.

```bash
curl -s -G -H "x-search-source: skill" \
  --data-urlencode "q=QUERY" \
  -d "sort=seeders" -d "limit=5" \
  "https://torrentclaw.com/api/v1/search"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. **In query text** (automatic parsing):
```bash
curl -s -G --data-urlencode "q=breaking bad S05E14" \
  "https://torrentclaw.com/api/v1/search"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Always use the `$TORRENTCLAW_API_KEY` environment variable via the `Authorization` header. Avoid passing the key as a query parameter — query strings may be logged in server access logs and HTTP referrer headers.

```bash
curl -s -G -H "Authorization: Bearer $TORRENTCLAW_API_KEY" \
  --data-urlencode "q=dune" \
  "https://torrentclaw.com/api/v1/search"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: Referencing an MCP server through an unpinned `npx @torrentclaw/mcp` command allows whatever the latest published package version is at execution time to run on the user's machine. If the package is compromised upstream or a breaking/malicious version is released, the skill guidance could cause remote code execution through the package manager supply chain.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation provides copy-pastable commands to search for torrents and immediately add magnet links to local clients like Transmission and aria2, as well as download .torrent files, without any warning, confirmation step, or discussion of legal and system-safety risks. In an agent skill whose purpose is to find and download copyrighted media, this materially increases the chance of unauthorized downloads and unintended interaction with local software.

External Transmission

Medium

• Category: Data Exfiltration

Content

;;
  aria2)
    # Check if aria2 RPC is running
    if curl -sf http://localhost:6800/jsonrpc -d '{"jsonrpc":"2.0","id":"test","method":"aria2.getVersion"}' >/dev/null 2>&1; then
      echo "Adding to aria2 via RPC..."
      if [ -n "$download_dir" ]; then
        payload=$(jq -n --arg url "$magnet_url" --arg dir "$download_dir" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

aria2_daemon="false"
if [ -n "$aria2_path" ]; then
  aria2_installed="true"
  if curl -sf http://localhost:6800/jsonrpc -d '{"jsonrpc":"2.0","id":"test","method":"aria2.getVersion"}' >/dev/null 2>&1; then
    aria2_daemon="true"
  fi
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$distro" in
      ubuntu|debian|pop|linuxmint|elementary)
        echo "Ubuntu/Debian:"
        echo "  sudo apt update && sudo apt install -y transmission-cli transmission-daemon"
        echo ""
        echo "Start daemon:"
        echo "  sudo systemctl start transmission-daemon"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.