Security audit

Sonarr

Security checks for vulnerabilities and agentic risk

Overview

This Sonarr skill mostly does what it says, but it also includes immediate show removal and optional media-file deletion that are not disclosed in the short manifest description.

Install only if you are comfortable giving this skill authority to modify your Sonarr library. Be especially careful with remove operations: --delete-files can delete media managed by Sonarr, and the script itself will not ask for another confirmation. Keep the Sonarr config file private and consider rotating the API key if process logs may capture command arguments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sonarr.sh:21
Finding: Sonarr API Key Exposed Through Process Command-Line Arguments
Content: View full analysis
http://localhost:8989/api/v3/... ``` Although the exposure window is limited to the lifetime of each `curl` process, the script makes multiple requests and may be invoked repeatedly. Process-monitoring or audit infrastructure may also retain command-line arguments after the process exits. Reading the dedicated configuration file at `~/.clawdbot/credentials/sonarr/config.json` is necessary for the Skill's declared functionality and does not itself exceed least privilege. The reviewed code does not access unrelated credential paths or transmit the key to an unrelated destination. The weakness is specifically the method used to transfer that key from the script to `curl`. ### Attack Path 1. The user invokes a command such as `search`, `config`, `add`, or `remove`. 2. The script reads the Sonarr API key from the dedicated configuration file. 3. It constructs the `AUTH` variable containing th ...[truncated 1329 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes shell commands (bash scripts/sonarr.sh ...) and depends on curl and jq, but the manifest does not declare permissions/capabilities accordingly. This creates an auditability and trust gap: consumers may underestimate the skill's execution privileges and the fact that it can make local/networked changes through shell execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose says the skill searches for and adds TV shows, but the documented behavior also includes existence checks, configuration enumeration, removal of shows, and optional deletion of files. This mismatch is dangerous because users or higher-level agents may authorize the skill for low-risk add/search operations while it actually supports destructive actions that can remove content and delete local media files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description omits the documented show-removal capability, including an option to delete files. Hiding destructive functionality in documentation rather than the manifest increases the risk of unsafe delegation, especially when an orchestrating agent or user relies on the manifest summary to decide what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata says it searches and adds TV shows, but the script also implements a remove command that can delete series from Sonarr. This is a capability mismatch that can mislead users or calling agents into invoking destructive behavior they did not expect, increasing the chance of unauthorized or accidental content removal.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script exposes a file-deletion path through Sonarr via the --delete-files option even though the stated purpose is only searching and adding shows. Hidden destructive functionality is especially risky in agent skills because orchestration layers may grant trust based on the manifest and unknowingly expose deletion of managed media files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The destructive delete-files path executes immediately with no confirmation, preview, or safeguard. In an agent context, a malformed request, prompt injection, or user misunderstanding could trigger irreversible media deletion without any last-chance validation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.