Radarr

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is mostly a normal Radarr integration, but it deserves review because collection adding can enable ongoing future auto-add/search behavior and the skill can remove media files.

Before installing, make sure you are comfortable giving the skill Radarr API access. Be especially careful with collection adds, because the script can turn on future monitoring and auto-add/search behavior, and review any remove command before allowing file deletion.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using this skill should understand that the configured API key lets the skill read and change the Radarr library.

Why it was flagged

The setup requires a Radarr API key stored in a local credentials file. This is expected for controlling Radarr, but it grants authority over the user's Radarr instance.

Skill content
"apiKey": "your-api-key"
Recommendation

Use a Radarr API key only for the intended Radarr instance, protect the config file, and avoid pointing the URL at untrusted services.

What this means

If used incorrectly, the skill could remove movies from Radarr and, with the delete flag, delete associated files.

Why it was flagged

The skill documents a removal command that can delete media files through Radarr, with an instruction to ask the user first.

Skill content
bash scripts/radarr.sh remove <tmdbId> --delete-files  # delete files too
**Always ask user if they want to delete files when removing!**
Recommendation

Only approve removal commands after checking the exact movie and whether files should be kept; prefer the default keep-files behavior unless deletion is intentional.

ConcernHigh Confidence
ASI10: Rogue Agents
What this means

A collection add can keep affecting Radarr later by automatically monitoring and adding/searching future releases, even after the original request is finished.

Why it was flagged

After adding a collection, the script persistently enables collection monitoring and search-on-add for future movies, creating ongoing behavior beyond the immediate add operation.

Skill content
# Monitor the collection for future movies
updatePayload=$(echo "$fullCollection" | jq '. + {monitored: true, searchOnAdd: true}')
Recommendation

Require explicit user confirmation before enabling collection monitoring, document the persistent effect clearly, and honor --no-search or provide a separate flag for future auto-add behavior.