Prowlarr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This Prowlarr skill is mostly coherent, but it gives an agent direct API power to delete or sync indexer configuration and stores an API key without enough safeguards.

Install only if you are comfortable giving the agent a Prowlarr API key that can change indexer configuration. Store the config file with owner-only permissions, prefer HTTPS, avoid putting the API key in shell history or shared environment files, and manually confirm any delete or sync request before allowing it to run.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:24
• Finding: Credential file may be created with overly permissive filesystem permissions<![CDATA[ ## Vulnerability Details **File Location**: `README.md:24-30` **Vulnerability Type**: Insecure credential storage permissions **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.clawdbot/credentials/prowlarr cat > ~/.clawdbot/credentials/prowlarr/config.json << 'EOF' { "url": "https://prowlarr.example.com", "apiKey": "your-api-key-here" } EOF ``` The resulting credential is read by `scripts/prowlarr-api.sh:7-11`: ```bash CONFIG_FILE="${PROWLARR_CONFIG:-$HOME/.clawdbot/credentials/prowlarr/config.json}" # Load config if [[ -f "$CONFIG_FILE" ]]; then PROWLARR_URL=$(jq -r '.url // empty' "$CONFIG_FILE") PROWLARR_API_KEY=$(jq -r '.apiKey // empty' "$CONFIG_FILE") ``` ### Technical Analysis The setup instructions create a directory and API-key file without assigning restrictive permissions. Their effective permissions therefore depend on the user's current `umask`. With a common `umask` of `022`, the directory may be created as mode `0755` and the configuration file as mode `0644`, making the API key readable by other local users. Accessing a Prowlarr credential is necessary for the Skill's declared functionality. However, granting potential read access to users other than the credential owner is not necessary and violates least-access principles for secret storage. The script also accepts a custom path through `PROWLARR_CONFIG` but does not verify the file's owner, permissions, or type before reading it. This increases exposure where the configured file is stored in an unsafe location, although exploitation still depends on local filesystem access and permissions. ### Attack Path 1. A user follows the documented setup commands while operating under a permissive `umask`. 2. The Prowlarr configuration is created with permissions that permit another local account or process to read it. 3. An attacker with local access enumerates or uses the documented path at `~/.clawdbot/credentials/prowlarr/config.json`. 4. The attacker r ...[truncated 891 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create the credential directory and file with owner-only permissions: ```bash install -d -m 700 "$HOME/.clawdbot/credentials/prowlarr" install -m 600 /dev/null "$HOME/.clawdbot/credentials/prowlarr/config.json" cat > "$HOME/.clawdbot/credentials/prowlarr/config.json" <<'EOF' { "url": "https://prowlarr.example.com", "apiKey": "your-api-key-here" } EOF ``` Alternatively, set a restrictive process mask before creating either object: ```bash umask 077 mkdir -p "$HOME/.clawdbot/credentials/prowlarr" ``` Additional hardening should include: 1. In the script, reject credential files that are symbolic links or are not regular files. 2. Verify that the file is owned by the current user. 3. Warn or fail if group or other permission bits are present. 4. Document that environment variables can also leak through process environments, diagnostics, or child processes and should not be treated as universally safer. 5. Rotate the Prowlarr API key if the file was previously stored with permissive permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/prowlarr-api.sh:26
• Finding: Prowlarr API key can be transmitted over unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/prowlarr-api.sh:26-36` **Vulnerability Type**: Plaintext transmission of an API credential **Risk Level**: Medium ### Vulnerable Code ```bash # Remove trailing slash PROWLARR_URL="${PROWLARR_URL%/}" # API call helper api() { local method="$1" local endpoint="$2" shift 2 curl -sS -X "$method" \ -H "X-Api-Key: ${PROWLARR_API_KEY}" \ -H "Content-Type: application/json" \ "$@" \ "${PROWLARR_URL}/api/v1${endpoint}" } ``` The endpoint is loaded without scheme validation at `scripts/prowlarr-api.sh:7-11`: ```bash CONFIG_FILE="${PROWLARR_CONFIG:-$HOME/.clawdbot/credentials/prowlarr/config.json}" # Load config if [[ -f "$CONFIG_FILE" ]]; then PROWLARR_URL=$(jq -r '.url // empty' "$CONFIG_FILE") PROWLARR_API_KEY=$(jq -r '.apiKey // empty' "$CONFIG_FILE") ``` ### Technical Analysis The script places the Prowlarr API key in the `X-Api-Key` request header but does not require the configured URL to use HTTPS. The documentation provides an HTTPS example, but neither the configuration loader nor the API helper rejects an `http://` URL. If HTTP is configured, the request header and API traffic are transmitted without transport encryption. A network-positioned attacker may observe the API key directly. An active attacker may also alter responses or requests because HTTP provides neither server authentication nor transport integrity. Sending the credential to a user-selected Prowlarr server is necessary for the declared functionality. Permitting unencrypted transport to non-loopback destinations is not necessary for normal secure operation and creates avoidable credential exposure. ### Attack Path 1. The user configures `PROWLARR_URL` or the JSON `url` field with an `http://` address. This may occur because a local deployment lacks TLS, because of a configuration mistake, or because an attacker influences setup instructions or configuration. 2. ...[truncated 1137 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Validate the configured URL before making any request and require HTTPS by default: ```bash case "$PROWLARR_URL" in https://*) ;; *) echo '{"error":"PROWLARR_URL must use HTTPS"}' >&2 exit 1 ;; esac ``` If plaintext HTTP is operationally required for a local Prowlarr installation: 1. Permit it only for explicit loopback destinations such as `127.0.0.1`, `[::1]`, or a securely resolved local Unix-socket proxy. 2. Require an explicit opt-in variable such as `PROWLARR_ALLOW_INSECURE_HTTP=1`. 3. Display a clear warning whenever insecure transport is enabled. 4. Do not broadly permit HTTP for private-network hostnames or addresses, because those networks may still be observable or hostile. 5. Keep curl's TLS certificate verification enabled. 6. Support a trusted private certificate authority through a configurable CA bundle rather than using `curl --insecure`. 7. Rotate the API key if it has previously traversed an untrusted plaintext connection. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

cmd_delete() {
    local id="$1"
    api DELETE "/indexer/$id"
    echo '{"status": "ok", "indexer": "'"$id"'", "deleted": true}'
}

• Confidence: 92% confidence
• Finding: The command directly interpolates a user-controlled id into a privileged DELETE API path, enabling the agent to perform destructive actions on arbitrary indexers. In an agent environment, this is a tool-parameter abuse risk because untrusted prompts or confused delegation can turn benign requests into irreversible administrative operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to place a long-lived Prowlarr API key directly into a plaintext config file under their home directory without any warning about file permissions, secret handling, or shell/history exposure during setup. While common in documentation, this can lead to credential disclosure through weak filesystem permissions, backups, screen sharing, or copied commands, and the key would allow authenticated access to Prowlarr management functions.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Go to **Settings → General → Security**
3. Copy your **API Key**

### 2. Create Credentials File

```bash
mkdir -p ~/.clawdbot/credentials/prowlarr

• Confidence: 84% confidence
• Finding: The documented approach establishes persistent local storage for an API credential in a reusable credentials path, which increases the lifetime and exposure surface of the secret. Persistent session credentials are not inherently malicious, but without guidance on secure storage, permission hardening, and rotation, they raise the chance of later compromise from local access, backups, or other tooling that reads dotfiles.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The environment-variable example tells users to export the API key directly in the shell but omits warnings that such commands may be captured in shell history, exposed to other local processes through environment inspection, or inherited by child processes. Because this skill manages Prowlarr and indexers, exposure of the key could permit unauthorized searches, indexer administration, or syncing actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs the agent to invoke shell commands, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an orchestration layer may permit broader shell access than intended, increasing the risk of command execution beyond the narrow Prowlarr use case.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents a delete operation for indexers with no warning, confirmation requirement, or indication that this action is destructive and may disrupt search and downstream automation. In an agent context, users may invoke documented commands indirectly, so lack of safeguards can lead to accidental configuration loss or service degradation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata emphasizes search and indexer management, but the script also includes a destructive delete capability that can permanently remove indexers. In an agent context, exposing deletion alongside routine search functionality increases the chance of accidental or prompt-induced destructive actions that exceed a typical user's expectation for this skill.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script exposes indexer deletion even though the stated use case is primarily searching and checking/syncing indexers. This mismatch broadens the tool's authority beyond what is clearly justified, which is dangerous in LLM-agent settings where tool misuse can be triggered by ambiguous, adversarial, or mistaken instructions.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The delete operation executes immediately with no interactive confirmation, dry-run mode, or secondary verification. That makes accidental deletion easy and gives an attacker or mis-prompted agent a single-step path to destructive state changes in Prowlarr.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The sync operation can modify connected applications such as Sonarr or Radarr, but the documentation does not warn that running it may overwrite or propagate configuration changes downstream. In this skill context, that is less severe than direct deletion but still dangerous because an agent may trigger broader unintended state changes across integrated systems.

Static analysis

No suspicious patterns detected.