Security audit
Security checks for vulnerabilities and agentic risk
This Radarr skill is mostly a coherent library-management helper, but it also allows movie removal, optional media-file deletion, and persistent collection auto-add behavior that are not strongly disclosed or gated.
Review this skill before installing if you want an add-only Radarr helper. Only use it with a Radarr API key you are comfortable granting library mutation rights, and treat remove, --delete-files, and add-collection as high-impact actions that should require explicit user confirmation.
## Setup
Create `~/.openclaw/credentials/radarr/config.json`:
```json
{
"url": "http://localhost:7878",}
')
result=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d "$addRequest" "$API/movie")
if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
echo "✅ Added: $(echo "$result" | jq -r '.title') ($(echo "$result" | jq -r '.year'))"}
')
result=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d "$addRequest" "$API/movie")
if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
echo "✅ Added: $(echo "$result" | jq -r '.title') ($(echo "$result" | jq -r '.year'))"fullCollection=$(curl -s -H "$AUTH" "$API/collection/$collectionId")
updatePayload=$(echo "$fullCollection" | jq '. + {monitored: true, searchOnAdd: true}')
updateResult=$(curl -s -X PUT -H "$AUTH" -H "Content-Type: application/json" -d "$updatePayload" "$API/collection/$collectionId")
if echo "$updateResult" | jq -e '.monitored' > /dev/null 2>&1; then
echo "👁️ Collection monitored (new releases auto-added)"No suspicious patterns detected.