Prowlarr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This Prowlarr skill is mostly coherent, but it gives an agent direct API power to delete or sync indexer configuration and stores an API key without enough safeguards.

Install only if you are comfortable giving the agent a Prowlarr API key that can change indexer configuration. Store the config file with owner-only permissions, prefer HTTPS, avoid putting the API key in shell history or shared environment files, and manually confirm any delete or sync request before allowing it to run.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:24

Finding

Credential file may be created with overly permissive filesystem permissions

Content

View full analysis

~/.clawdbot/credentials/prowlarr/config.json << 'EOF' { "url": "https://prowlarr.example.com", "apiKey": "your-api-key-here" } EOF ``` The resulting credential is read by `scripts/prowlarr-api.sh:7-11`: ```bash CONFIG_FILE="${PROWLARR_CONFIG:-$HOME/.clawdbot/credentials/prowlarr/config.json}" # Load config if [[ -f "$CONFIG_FILE" ]]; then PROWLARR_URL=$(jq -r '.url // empty' "$CONFIG_FILE") PROWLARR_API_KEY=$(jq -r '.apiKey // empty' "$CONFIG_FILE") ``` ### Technical Analysis The setup instructions create a directory and API-key file without assigning restrictive permissions. Their effective permissions therefore depend on the user's current `umask`. With a common `umask` of `022`, the directory may be created as mode `0755` and the configuration file as mode `0644`, making the API key readable by other local users. Accessing a Prowlarr credential is necessary for the Skill's declared functionality. However, granting potential read access to users other than the credential owner is not necessary and violates least-access principles for secret storage. The script also accepts a custom path through `PROWLARR_CONFIG` but does not verify the file's owner, permissions, or type before reading it. This increases exposure where the configured file is stored in an unsafe location, although exploitation still depends on local filesystem access and permissions. ### Attack Path 1. A user follows the documented setup commands while operating under a permissive `umask`. 2. The Prowlarr configuration is created with permissions that permit another local account or process to read it. 3. An attacker with local access enumerates or uses the documented path at `~/.clawdbot/credentials/prowlarr/config.json`. 4. The attacker r ...[truncated 891 chars]

Remediation

View remediation

"$HOME/.clawdbot/credentials/prowlarr/config.json" <<'EOF' { "url": "https://prowlarr.example.com", "apiKey": "your-api-key-here" } EOF ``` Alternatively, set a restrictive process mask before creating either object: ```bash umask 077 mkdir -p "$HOME/.clawdbot/credentials/prowlarr" ``` Additional hardening should include: 1. In the script, reject credential files that are symbolic links or are not regular files. 2. Verify that the file is owned by the current user. 3. Warn or fail if group or other permission bits are present. 4. Document that environment variables can also leak through process environments, diagnostics, or child processes and should not be treated as universally safer. 5. Rotate the Prowlarr API key if the file was previously stored with permissive permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/prowlarr-api.sh:26

Finding

Prowlarr API key can be transmitted over unencrypted HTTP

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` If plaintext HTTP is operationally required for a local Prowlarr installation: 1. Permit it only for explicit loopback destinations such as `127.0.0.1`, `[::1]`, or a securely resolved local Unix-socket proxy. 2. Require an explicit opt-in variable such as `PROWLARR_ALLOW_INSECURE_HTTP=1`. 3. Display a clear warning whenever insecure transport is enabled. 4. Do not broadly permit HTTP for private-network hostnames or addresses, because those networks may still be observable or hostile. 5. Keep curl's TLS certificate verification enabled. 6. Support a trusted private certificate authority through a configurable CA bundle rather than using `curl --insecure`. 7. Rotate the API key if it has previously traversed an untrusted plaintext connection. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The command directly interpolates a user-controlled id into a privileged DELETE API path, enabling the agent to perform destructive actions on arbitrary indexers. In an agent environment, this is a tool-parameter abuse risk because untrusted prompts or confused delegation can turn benign requests into irreversible administrative operations.

Content

Scanner excerpt · scripts/prowlarr-api.sh (reported line 270)May include surrounding context.

sh

cmd_delete() {
    local id="$1"
    api DELETE "/indexer/$id"
    echo '{"status": "ok", "indexer": "'"$id"'", "deleted": true}'
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to place a long-lived Prowlarr API key directly into a plaintext config file under their home directory without any warning about file permissions, secret handling, or shell/history exposure during setup. While common in documentation, this can lead to credential disclosure through weak filesystem permissions, backups, screen sharing, or copied commands, and the key would allow authenticated access to Prowlarr management functions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The documented approach establishes persistent local storage for an API credential in a reusable credentials path, which increases the lifetime and exposure surface of the secret. Persistent session credentials are not inherently malicious, but without guidance on secure storage, permission hardening, and rotation, they raise the chance of later compromise from local access, backups, or other tooling that reads dotfiles.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

2. Go to Settings → General → Security
3. Copy your API Key

2. Create Credentials File

bash

mkdir -p ~/.clawdbot/credentials/prowlarr

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The environment-variable example tells users to export the API key directly in the shell but omits warnings that such commands may be captured in shell history, exposed to other local processes through environment inspection, or inherited by child processes. Because this skill manages Prowlarr and indexers, exposure of the key could permit unauthorized searches, indexer administration, or syncing actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill clearly instructs the agent to invoke shell commands, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an orchestration layer may permit broader shell access than intended, increasing the risk of command execution beyond the narrow Prowlarr use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a delete operation for indexers with no warning, confirmation requirement, or indication that this action is destructive and may disrupt search and downstream automation. In an agent context, users may invoke documented commands indirectly, so lack of safeguards can lead to accidental configuration loss or service degradation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata emphasizes search and indexer management, but the script also includes a destructive delete capability that can permanently remove indexers. In an agent context, exposing deletion alongside routine search functionality increases the chance of accidental or prompt-induced destructive actions that exceed a typical user's expectation for this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script exposes indexer deletion even though the stated use case is primarily searching and checking/syncing indexers. This mismatch broadens the tool's authority beyond what is clearly justified, which is dangerous in LLM-agent settings where tool misuse can be triggered by ambiguous, adversarial, or mistaken instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The delete operation executes immediately with no interactive confirmation, dry-run mode, or secondary verification. That makes accidental deletion easy and gives an attacker or mis-prompted agent a single-step path to destructive state changes in Prowlarr.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The sync operation can modify connected applications such as Sonarr or Radarr, but the documentation does not warn that running it may overwrite or propagate configuration changes downstream. In this skill context, that is less severe than direct deletion but still dangerous because an agent may trigger broader unintended state changes across integrated systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.