Trakt.tv Integration

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:35 AM UTC
• Version: 1.1.0

Overview

This appears to be a real Trakt.tv integration, but it asks the agent to handle and persist sensitive account credentials in plaintext, so users should review it before installing.

Install only if you are comfortable giving this skill ongoing access to your Trakt account and viewing data. Prefer a virtual environment for dependencies, use the narrowest Trakt app permissions possible, protect ~/.openclaw/trakt_config.json with owner-only permissions, avoid sharing secrets in chat or logs, and require confirmation before any command that changes watch history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print_info("Installing requests...")
        
        try:
            subprocess.run([
                sys.executable, "-m", "pip", "install", 
                "requests", "--break-system-packages"
            ], check=True, capture_output=True)

• Confidence: 79% confidence
• Finding: subprocess.run([ sys.executable, "-m", "pip", "install", "requests", "--break-system-packages" ], check=True, capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif sys.platform == 'linux':
            subprocess.run(['xdg-open', url], check=False)
        elif sys.platform == 'win32':
            subprocess.run(['start', url], shell=True, check=False)
        print_success(f"Opened {url}")
    except Exception as e:
        print_info(f"Please visit: {url}")

• Confidence: 92% confidence
• Finding: subprocess.run(['start', url], shell=True, check=False)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif sys.platform == 'linux':
                subprocess.run(['xdg-open', pin_url], check=False)
            elif sys.platform == 'win32':
                subprocess.run(['start', pin_url], shell=True, check=False)
            print_success(f"Opened {pin_url}")
        except:
            print_info(f"Please visit: {pin_url}")

• Confidence: 96% confidence
• Finding: subprocess.run(['start', pin_url], shell=True, check=False)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to use shell commands, access local files, write a persistent config file, and make network requests, but it does not declare those permissions. Hidden or undeclared capabilities reduce user visibility and policy enforcement, especially because the file stores OAuth client secrets and tokens in the user's home directory.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The setup wizard performs runtime package installation despite being a TV/movie integration helper, which grants it broader system-modification capability than users may expect. Combined with pip network retrieval and --break-system-packages, this creates unnecessary supply-chain and host-integrity risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The installation guide instructs the agent to collect a Client Secret and write it in plaintext to ~/.openclaw/trakt_config.json without any explicit warning about sensitivity, local access risks, or file-permission hardening. In an agentic setup, prompting users for secrets and persisting them unencrypted increases the chance of credential exposure through other local users, backups, logs, or accidental disclosure.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README states that the skill 'automatically triggers when Trakt-related queries are detected' without defining clear activation boundaries, confirmation requirements, or limits on what user context may be used. In a skill that can access personalized watch history and watchlist data, overly broad triggering can cause unintended invocation and privacy-impacting disclosure of account-linked data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to store the OAuth client secret, access token, and refresh token in a local JSON file under the home directory, but provides no warning about credential sensitivity, file permissions, or local privacy risks. If that file is readable by other local users, included in backups, or exposed through logs or support bundles, an attacker could reuse tokens or secrets to access the user's Trakt account and viewing data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill does not clearly warn users that recommendations, history, and watchlist features rely on accessing and processing their Trakt viewing data. Because this data can reveal personal habits and preferences, silent access creates a privacy and consent problem, especially when tied to an authenticated third-party account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script stores client_secret and future OAuth tokens in a plaintext file under the user's home directory without setting restrictive permissions or clearly warning the user. If the host is multi-user, backed up insecurely, or otherwise accessed by malware, these credentials can be exfiltrated and used to access the user's Trakt account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client writes the Trakt client secret, access token, and refresh token to a local JSON file in the user's home directory without setting restrictive file permissions or warning the user that long-lived credentials are being stored. On multi-user systems, shared environments, backups, or malware-compromised hosts, these secrets could be recovered and used to access or modify the user's Trakt account.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This code performs state-changing actions against the user's external Trakt account by marking content as watched, but the operation itself contains no confirmation, warning, or dry-run safeguard. In an agent skill context, that increases the risk of unintended account modification if the action is triggered by ambiguous prompts, tool misuse, or prompt injection elsewhere in the system.

External Transmission

Medium

• Category: Data Exfiltration

Content

"client_secret": self.client_secret
        }
        
        response = requests.post(url, json=payload, headers=self._get_headers())
        
        if response.status_code == 200:
            data = response.json()

• Confidence: 88% confidence
• Finding: requests.post(url, json=

Session Persistence

Medium

• Category: Rogue Agent

Content

2. **Trakt.tv account** with Pro subscription (required for automatic watch tracking)

3. **Trakt API application** - Create at <https://trakt.tv/oauth/applications>

4. **Configuration file:** `~/.openclaw/trakt_config.json` (see setup below)

• Confidence: 90% confidence
• Finding: Create at <https://trakt.tv/oauth/applications> 4. **Configuration file:** `~/.openclaw/trakt_config.json` (see setup below) ## Setup ### 1. Create Trakt Application 1. Visit <https://trakt.tv/oau

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

• Confidence: 93% confidence
• Finding: requests>=2.31.0

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

elif sys.platform == 'linux':
            subprocess.run(['xdg-open', url], check=False)
        elif sys.platform == 'win32':
            subprocess.run(['start', url], shell=True, check=False)
        print_success(f"Opened {url}")
    except Exception as e:
        print_info(f"Please visit: {url}")

• Confidence: 94% confidence
• Finding: subprocess.run(['start', url], shell=True

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

elif sys.platform == 'linux':
                subprocess.run(['xdg-open', pin_url], check=False)
            elif sys.platform == 'win32':
                subprocess.run(['start', pin_url], shell=True, check=False)
            print_success(f"Opened {pin_url}")
        except:
            print_info(f"Please visit: {pin_url}")

• Confidence: 97% confidence
• Finding: subprocess.run(['start', pin_url], shell=True

VirusTotal

54/54 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.