ClawHub
Back to skill

Security audit

Sonarr Fixed

Security checks for vulnerabilities and agentic risk

Overview

This Sonarr skill mostly does what it says, but it can also remove shows and delete media files with limited safeguards.

Review before installing. Use this only with a Sonarr API key you are comfortable granting library mutation rights to, and be especially careful with any remove request because --delete-files can delete media files. Prefer confirming the exact TVDB ID and deletion choice yourself before allowing the command to run.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared description says the skill searches and adds TV shows, but the documented commands also remove shows, optionally delete files, and expose configuration/listing functionality. This mismatch is dangerous because users or automated policy systems may grant or invoke the skill under the assumption it is non-destructive, while it actually supports destructive actions that could delete media files.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill metadata says it searches and adds TV shows, but the script also supports removing series and optionally deleting files from disk. This capability mismatch is dangerous because users or higher-level agents may invoke the skill assuming it is non-destructive, leading to unintended data loss.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises shell-based execution (`bash scripts/sonarr.sh ...`) but does not declare any explicit tool scope such as `permissions` or `allowed-tools`. That creates an authorization and transparency gap: an agent platform or reviewer may not realize the skill can invoke shell commands against local resources and configured credentials.

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

Create `~/.openclaw/credentials/sonarr/config.json`:
```json
{
  "url": "http://localhost:8989",
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    ')
    
    result=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d "$addRequest" "$API/series")
    
    if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
      title=$(echo "$result" | jq -r '.title')
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The remove command issues immediate deletion requests, and with --delete-files it can also remove underlying media files, without any confirmation or safety interlock. In an agentic context, argument mistakes, prompt injection, or misunderstanding of the skill's capabilities can trigger irreversible destructive actions.

Missing User Warnings

Low
Confidence
90% confidence
Finding
This code accesses a sensitive credential source and loads an API key into memory, but provides no prompt, comment explaining the sensitivity beyond a file path note, or user-facing disclosure at the time of use. For code files, sensitive environment or credential access should have some form of visible warning or documentation unless clearly covered elsewhere.

Static analysis

No suspicious patterns detected.