Aria2 Rpc

Remote control for aria2 download service via JSON-RPC 2.0. Supports adding downloads (HTTP/FTP/Torrent/Magnet), querying task status, pausing/resuming, and...

Security Scan

The skill's files and instructions match its stated purpose (remote control of aria2 via JSON-RPC); minor documentation/metadata inconsistencies are present but there is no evidence of hidden or unrelated behavior.

Purpose & Capability

The name/description (aria2 RPC client) align with the included Python client and docs. The metadata lists required binaries as curl and python3; the shipped client uses python3+requests (no use of curl in the code), and the docs mention running aria2c to enable RPC but aria2/aria2c is not listed as a required binary — this is a small inconsistency in metadata vs. instructions, not a functional mismatch.

Instruction Scope

SKILL.md instructs the agent/user to install requests, enable aria2 RPC, set ARIA2_RPC_URL/ARIA2_RPC_SECRET, and run the provided script. The runtime instructions and script operate on aria2 RPC endpoints and only read local files when explicitly asked (e.g., reading a .torrent/.metalink file supplied by the user). There are no instructions to read arbitrary system files, exfiltrate data to unexpected endpoints, or perform actions outside the aria2 domain.

Install Mechanism

This is an instruction-only skill (no installer). The only runtime dependency is the requests Python package (installable via pip); no external downloads or archive extraction are performed by the skill itself.

Credentials

No credentials are required by the registry metadata. The skill accepts optional ARIA2_RPC_URL and ARIA2_RPC_SECRET environment variables as expected for an RPC client. It does not request unrelated secrets or multiple unrelated environment variables.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent/always-on privilege or attempt to modify other skills or global agent configuration. File paths referenced are the skill's own script location or user-supplied files.

Assessment

This skill appears to be a straightforward aria2 JSON-RPC client and is internally consistent. Before installing, check these small issues: (1) the metadata lists curl as a required binary even though the Python client uses requests — curl is not necessary; (2) the docs show running aria2c to enable RPC but aria2c is not declared as a required binary — if you plan to control a local aria2 instance you must have aria2/aria2c available; (3) be careful which RPC URL and secret you supply — the script will send commands (and in the case of add-torrent/add-metalink will read local files you point it at and encode/send them) to whatever RPC endpoint is configured; ensure that endpoint is trusted; (4) review scripts/aria2_rpc.py yourself if you need higher assurance. If you only intend to control a local aria2 instance, use defaults and keep ARIA2_RPC_SECRET private.

aria2-rpc Skill

通过 JSON-RPC 2.0 协议远程控制 aria2 下载服务。

功能

• 添加 HTTP/FTP/Magnet/Torrent 下载
• 查询任务状态、暂停/继续/删除任务
• 获取全局统计和配置
• 支持远程 aria2 实例和 RPC 认证

安装

# 安装依赖
pip3 install requests

# 配置 aria2（启用 RPC）
aria2c --enable-rpc --rpc-listen-all=true --rpc-secret=mytoken -D

快速开始

# 添加下载
python3 /root/.openclaw/workspace/skills/aria2-rpc/scripts/aria2_rpc.py add-uri "http://example.com/file.zip" --rpc-secret mytoken

# 查看进度
python3 scripts/aria2_rpc.py tell-active --rpc-secret mytoken

环境变量

export ARIA2_RPC_URL="http://localhost:6800/jsonrpc"
export ARIA2_RPC_SECRET="your-secret-token"

脚本路径

• 主脚本: /root/.openclaw/workspace/skills/aria2-rpc/scripts/aria2_rpc.py

详细文档

• 快速开始
• 配置指南
• 使用示例
• API 参考
• 配置示例