Shows
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: shows Version: 1.0.0 The skill bundle describes a legitimate show-tracking functionality involving local file system operations within `~/shows/` and potential external network requests (e.g., for release dates, platform availability via 'JustWatch'). While there is no explicit malicious intent in the instructions (no data exfiltration, backdoors, or obfuscation), the described capabilities introduce potential vulnerabilities. Specifically, instructions for the AI agent to 'Suggest checking JustWatch or similar aggregator' and to look up 'Platform changes' or 'Award Season' data imply external network interactions. If the agent's underlying implementation for these actions processes user input without robust sanitization, it could lead to Server-Side Request Forgery (SSRF) or other injection vulnerabilities, classifying it as suspicious due to the inherent risk of exploitation rather than intentional malice.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may add, move, or update entries in the user’s show-tracking files.
The skill directs the agent to mutate local tracking records based on user commands. This is purpose-aligned and scoped, but users should expect local file changes.
"Watching Severance" | Add to watching, ask current episode; "Finished The Bear S3" | Move to completed, ask rating
Keep the tracker in the intended `~/shows/` directory and review entries if accuracy matters.
Local notes may reveal household viewing habits, children’s preferences, ages, and reactions if the files are shared or exposed.
The skill can persist family-member details, including children’s ages, and later reuse that context for recommendations.
`~/shows/people.md` ... `- Emma (age 8)` ... `- Lucas (age 12)`
Avoid adding sensitive personal details unless needed, and periodically review or delete stored family data.