Jellyseerr

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:15 AM UTC
• Version: 1.0.0

Overview

This skill mostly matches its Jellyseerr purpose, but its notification setup creates persistent system services and an unauthenticated network listener that need careful review before use.

Install the basic search and request scripts only if you are comfortable storing a Jellyseerr API key in ~/.config/jellyseerr/config.json and allowing the skill to submit media requests. Treat the webhook setup as an administrator-level Review item: inspect the service file, restrict port 8384 to Jellyseerr or localhost, avoid broad firewall exposure, consider HTTPS or authentication, and know how to disable the systemd service or cron job before enabling persistent notifications.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises operational capabilities including shell execution, file writes, network access, and environment/config handling, but does not declare permissions or boundaries for those actions. That creates a transparency and consent problem: users may invoke a seemingly simple media-request skill without understanding it can alter local state, contact remote services, or run system commands.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The stated purpose focuses on requesting/searching media, but the documented behavior expands into running a webhook server on 0.0.0.0, installing a system service, performing background monitoring, and managing notification queues. This mismatch is dangerous because it hides persistent network-exposed and privileged behaviors behind an innocuous description, increasing the chance of unsafe deployment or over-trust by users.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script installs and starts a persistent systemd-managed webhook receiver, which materially expands the skill's capabilities beyond media request/search management into host-level service deployment and network exposure. This increases attack surface and creates a long-lived execution path that is not obviously necessary for the stated skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Creating a system service, reloading systemd, enabling autostart, and starting the service grants the skill lifecycle-management behavior on the host that is not justified by the manifest description. Even if intended for convenience, this kind of privileged persistence is dangerous in an agent skill because it can outlive the invoking session and expose a local server continuously.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file implements a network-facing webhook receiver that persists and prepares Telegram-directed notifications, which extends beyond the stated skill purpose of requesting and managing Jellyseerr media. This scope expansion creates an undocumented data flow from webhook input to external messaging metadata, increasing the chance of unintended data handling and abuse if the endpoint receives untrusted or spoofed requests.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code reads Telegram-specific identifiers from config and environment despite the skill being described only as a Jellyseerr media request tool. Accessing unrelated messaging configuration broadens the data and privilege surface, and in this context suggests hidden integration capability not disclosed by the skill's stated purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to run a sudo-based installer and to modify crontab for recurring execution, but it does not warn about the security implications of privileged installation or persistence. Such changes can create long-lived execution paths, expand attack surface, and make recovery harder if the scripts are flawed, compromised, or misconfigured.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to expose an unauthenticated HTTP webhook endpoint and later open the firewall port, but it does not warn that notification contents will traverse the network in cleartext and that the listener may be reachable by other hosts. In this skill context, the webhook carries media request metadata rather than highly sensitive secrets, so the impact is moderate, but network exposure still increases the attack surface and can leak usage information or permit spoofed requests if the server lacks validation.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The script unconditionally runs `chmod +x` on every Python file in its script directory, modifying local file permissions without any user notice or confirmation. While this is not directly code execution by itself, silently changing permissions can violate least-privilege expectations, make unintended scripts executable, and slightly increase the risk of accidental or follow-on execution in an automation context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prompts for an API key and persists it to disk without clearly warning the user that the secret will be stored locally in plaintext JSON. Although file permissions are tightened afterward, the credential remains recoverable by the local user and may be exposed through backups, filesystem compromise, or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The handler logs the full webhook JSON payload, which can include media titles, usernames, request details, and other personal or operational metadata. In a network-exposed webhook service, verbose logging of unredacted request bodies can leak sensitive information to log files, monitoring systems, or other users with log access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{
  "server_url": "$SERVER_URL",
  "api_key": "$API_KEY",
  "auto_approve": true
}
EOF

• Confidence: 89% confidence
• Finding: auto_approve

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Reload systemd and enable service
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

• Confidence: 93% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Reload systemd and enable service
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

echo "✓ Webhook server installed and started on port $PORT"

• Confidence: 95% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Reload systemd and enable service
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

echo "✓ Webhook server installed and started on port $PORT"
echo ""

• Confidence: 94% confidence
• Finding: sudo

Session Persistence

Medium

• Category: Rogue Agent

Content

WantedBy=multi-user.target
EOF

# Reload systemd and enable service
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

• Confidence: 94% confidence
• Finding: systemd and enable

Session Persistence

Medium

• Category: Rogue Agent

Content

# Reload systemd and enable service
sudo systemctl daemon-reload
sudo systemctl enable ${SERVICE_NAME}
sudo systemctl start ${SERVICE_NAME}

echo "✓ Webhook server installed and started on port $PORT"

• Confidence: 96% confidence
• Finding: systemctl enable

Session Persistence

Medium

• Category: Rogue Agent

Content

SERVICE_NAME="jellyseerr-webhook"
PORT="${1:-8384}"

# Create systemd service file
sudo tee /etc/systemd/system/${SERVICE_NAME}.service > /dev/null << EOF
[Unit]
Description=Jellyseerr Webhook Receiver

• Confidence: 91% confidence
• Finding: Create systemd service file

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.