Security audit

ClawARR Suite

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent media-stack control tool, but it handles powerful service keys, browser storage, package installs, and Docker/SSH commands in ways that deserve careful review before installation.

Install only if you are comfortable giving the agent operational control of your media stack. Use least-privilege service keys where possible, avoid running the sudo curl installer, avoid unpinned pip installs unless you trust those packages, do not paste secrets into the browser UI on a shared origin, prefer HTTPS or a trusted management LAN, and review Docker/SSH environment values before using companion-service commands.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/setup-guide.md:359
Finding: Remote Installer Executed Directly with Root Privileges
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/trackers.sh:150
Finding: Unpinned Traktarr and Retraktarr Packages Installed from the Active Python Package Index
Content: View full analysis
/dev/null; then pip3 install --user traktarr elif command -v pip &> /dev/null; then pip install --user traktarr else echo "❌ pip not found. Install Python first." exit 1 fi fi ``` The same pattern is used for Retraktarr: ```bash if [[ "$install" == "y" ]]; then echo "" echo "Installing retraktarr via pip..." if command -v pip3 &> /dev/null; then pip3 install --user retraktarr elif command -v pip &> /dev/null; then pip install --user retraktarr else echo "❌ pip not found. Install Python first." exit 1 fi fi ``` Related unpinned installation instructions also appear at: - `references/traktarr-retraktarr.md:49` - `references/traktarr-retraktarr.md:52` - `references/traktarr-retraktarr.md:628` ### Technical Analysis The setup wizard resolves package names against the user's currently configured pip index without pinning package versions or verifying distribution hashes. The package and its transitive dependencies can consequently change after this Skill is audited. Python package installation may execute build backends or setup hooks during installation. Installed command-line applications are subsequently invoked and receive access to Trakt credentials, Radarr/Sonarr API keys, library information, and the user's network environment. The `--user` option limits installation to the current account but does not make arbitrary package execution safe. ### Attack Path 1. An attacker compromises a package release, maintainer account, dependency, package index, or the user's pip index configuration. 2. The setup wizard offers to install Traktarr or Retraktarr. 3. The user accepts the installatio ...[truncated 627 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/recyclarr.sh:13
Finding: Remote Shell Command Injection in SSH Docker Wrappers
Content: View full analysis
&1 elif command -v recyclarr &>/dev/null; then recyclarr "$@" 2>&1 else ${DOCKER_CMD} exec "${CONTAINER}" recyclarr "$@" 2>&1 fi } docker_exec() { if [[ -n "$DOCKER_HOST_SSH" ]]; then ssh "$DOCKER_HOST_SSH" "${DOCKER_CMD} $*" 2>&1 else ${DOCKER_CMD} "$@" 2>&1 fi } ``` Equivalent unsafe remote-command construction occurs in: - `scripts/kometa.sh:14-26` - `scripts/unpackerr.sh:12-16` Additional remote shell interpolation involving a configurable path occurs at `scripts/recyclarr.sh:93`: ```bash ssh "$DOCKER_HOST_SSH" "cat ${DOCKER_CONFIG_BASE:-/volume1/docker}/recyclarr/recyclarr.yml 2>/dev/null || echo 'No config found'" ``` ### Technical Analysis Although the SSH destination is quoted locally, the command passed to SSH is a single string interpreted by the remote login shell. `$*` flattens all arguments into unescaped text. Environment-controlled values such as `RECYCLARR_DOCKER_CMD`, `RECYCLARR_CONTAINER`, and `DOCKER_CONFIG_BASE`, along with selected command arguments, are also interpolated directly. Shell metacharacters in these values can therefore terminate the intended Docker command and introduce additional commands on the remote host. Quoting the outer local string does not prevent parsing by the remote shell. Access to the Docker socket is commonly equivalent to root-level host control, so injection into these wrappers may have greater impact than the SSH account's apparent Unix permissions suggest. ### Attack Path 1. An attacker influences an invocation argument or a relevant environment variable, such as the container name, Docker command, configuration root, sync target, library n ...[truncated 789 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/trakt.sh:1482
Finding: Media-Service and Trakt Credentials Written and Displayed in Plaintext
Content: View full analysis
/dev/null || cat "$config_file" ``` The generated file contains plaintext credentials: ```bash cat > "$config_file" <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: ui/index.html:629
Finding: Browser Stores API Keys Persistently and Sends Them in Plaintext URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/trakt.sh:1182
Finding: LAN API Keys and Viewing History Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (178)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup instructions state that the script 'auto-discovers services, extracts API keys, verifies connections, and outputs your config' without a corresponding warning about credential harvesting, where the keys come from, how they are stored, or who can read the generated output. That is dangerous because API keys and tokens for Sonarr, Radarr, Plex, Tautulli, and related services often grant broad administrative control, and automatic extraction lowers the barrier to over-privileged access or accidental credential exposure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding identifies undeclared Docker/SSH container inspection and restart capabilities, which are materially privileged compared with ordinary media-management tasks. Remote container access can reveal environment secrets, service configuration, and allow operational disruption if restart actions are triggered on the wrong host.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 40)May include surrounding context.
md
- `GET /series/lookup?term=<query>` - Search for series - `POST /series` - Add series - `PUT /series/{id}` - Update series - `DELETE /series/{id}` - Delete series ### Episodes - `GET /episode` - All episodes

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 50)May include surrounding context.
md
### Queue - `GET /queue` - Download queue - `GET /queue/{id}` - Queue item details - `DELETE /queue/{id}?removeFromClient=true` - Remove from queue ### History - `GET /history?pageSize=20&sortKey=date&sortDirection=descending` - History

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 99)May include surrounding context.
md
### Queue - `GET /queue` - Download queue - `GET /queue/{id}` - Queue item details - `DELETE /queue/{id}?removeFromClient=true` - Remove from queue ### History - `GET /history?pageSize=20&sortKey=date&sortDirection=descending` - History

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 95)May include surrounding context.
md
- `GET /movie/lookup/tmdb?tmdbId=<id>` - Lookup by TMDB ID - `POST /movie` - Add movie - `PUT /movie/{id}` - Update movie - `DELETE /movie/{id}` - Delete movie ### Queue - `GET /queue` - Download queue

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 131)May include surrounding context.
md
- `GET /artist/{id}` - Single artist - `GET /search?term=<query>` - Search - `POST /artist` - Add artist - `DELETE /artist/{id}` - Delete artist ### Albums - `GET /album` - All albums

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 140)May include surrounding context.
md
### Queue - `GET /queue` - Download queue - `DELETE /queue/{id}` - Remove from queue ### Quality Profiles - `GET /qualityprofile` - All quality profiles

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 167)May include surrounding context.
md
### Queue - `GET /queue` - Download queue - `DELETE /queue/{id}` - Remove from queue ### Quality Profiles - `GET /qualityprofile` - All quality profiles

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 157)May include surrounding context.
md
- `GET /author/{id}` - Single author - `GET /author/lookup?term=<query>` - Search authors - `POST /author` - Add author - `DELETE /author/{id}` - Delete author ### Books - `GET /book` - All books

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-endpoints.md (reported line 178)May include surrounding context.
md
- `GET /indexer/{id}` - Single indexer - `POST /indexer` - Add indexer - `PUT /indexer/{id}` - Update indexer - `DELETE /indexer/{id}` - Delete indexer - `POST /indexer/test` - Test indexer - `POST /indexer/testall` - Test all indexers

Static analysis

No suspicious patterns detected.