Trakt.tv

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:28 AM UTC
• Version: 1.0.0

Overview

This is a legitimate Trakt.tv integration, but it lets an agent read and change your Trakt account and requires careful token handling.

Install only if you are comfortable letting the agent use your Trakt account. Keep the client secret, access token, and refresh token private, avoid sharing terminal output or committing config files, restrict local config access where possible, and revoke or rotate Trakt tokens if exposed. Ask for confirmation before removals, ratings, watch-history changes, or bulk updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to execute shell commands (`curl`) but does not declare any corresponding permission boundary. That creates a trust and review gap: an operator may enable the skill expecting passive API guidance while it is actually capable of networked command execution against authenticated endpoints.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose says the skill manages Trakt content, but the body also walks the user through OAuth credential acquisition, secret handling, and token output for local storage. This mismatch matters because reviewers and users may not realize the skill processes sensitive credentials and refresh tokens, expanding the attack surface beyond simple media-management actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README encourages authenticated use of Trakt features that can add, remove, rate, and mark content as watched, but it does not clearly warn users that the skill can perform persistent account-modifying actions on their behalf. In an agent-driven environment, that omission can lead users to grant tokens without understanding that prompts or agent mistakes could alter watchlists, history, collections, and ratings.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill includes account-modifying operations such as adding/removing watchlist entries, history changes, collection updates, and ratings, but gives no confirmation or safety guidance before executing them. In an agent setting, this can lead to unintended state changes from ambiguous prompts or prompt-injection-driven actions on the user's account.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script prints the client secret, access token, and refresh token directly to the terminal and includes them in shell export commands. This can expose credentials through terminal scrollback, session logging, screen sharing, shoulder surfing, or shell history if copied and pasted, making later account compromise possible.

Credential Access

High

• Category: Privilege Escalation

Content

- **Redirect URI**: `urn:ietf:wg:oauth:2.0:oob`
4. Save and note your **Client ID** and **Client Secret**

### Step 2: Get OAuth Access Token

Run the included helper script:

• Confidence: 91% confidence
• Finding: The README instructs users to obtain and store a client secret, access token, and refresh token for a skill that an agent will use, creating a high-value credential exposure risk if the host, logs, config files, or downstream tooling are compromised. In an agent context, long-lived OAuth material can enable sustained unauthorized access to the user's Trakt account and persistent modification of account data.

Credential Access

High

• Category: Privilege Escalation

Content

When the user asks to interact with Trakt:

1. **Always use curl** with proper headers including the access token
2. **Required headers** for all requests:
   - `trakt-api-version: 2`
   - `trakt-api-key: $TRAKT_CLIENT_ID`

• Confidence: 88% confidence
• Finding: The skill is designed to use bearer access tokens and also documents obtaining and storing refresh tokens and client secrets. Handling long-lived credentials in shell-oriented workflows increases the chance of accidental disclosure through command history, logs, screenshots, copied output, or reuse by other tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

Before using this skill, you need to set up Trakt API credentials:

1. Create a Trakt application at https://trakt.tv/oauth/applications
2. Get your Client ID and Client Secret
3. Complete OAuth flow to get an access token
4. Set environment variables in `~/.openclaw/openclaw.json`:

• Confidence: 84% confidence
• Finding: The skill instructs users to persist access and refresh tokens in a local configuration file, creating durable session material on disk. If that file is accessible to other local processes, backups, or users, an attacker could reuse the session to act on the user's Trakt account without re-authentication.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.