Stremio Casting
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill broadly matches its casting purpose, but its code uses a hard-coded Stremio server that does not match the described local setup and runs reduced-safety browser/device-control automation.
Review and edit the script before installing. Confirm it points to your own Stremio service, verify the Chromecast device name, install Playwright and CATT from trusted sources, and be cautious with the disabled browser certificate and sandbox protections.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may believe the skill only uses their local Stremio service when it is actually configured to use a specific hard-coded server address.
The documentation tells users the stream comes from a local Stremio service, but the included script hard-codes a different stremio.rocks streaming server using a specific 192.168.15.162 address and port 12470.
Intercepta a URL do stream gerada pelo servidor local do Stremio (`127.0.0.1:11470`).
Update the skill to discover or require the user's own Stremio server URL, and make the actual network target clear before casting.
The agent could cast an unintended or unverified stream to a local device, and browser traffic is made less protected by the disabled sandbox/certificate checks.
The script uses a hard-coded streaming server, launches a browser with reduced safety checks, and then sends the captured stream URL to CATT to control a Chromecast.
streamingServer=https%3A%2F%2F192-168-15-162.519b6502d940.stremio.rocks%3A12470 ... args=['--no-sandbox', '--disable-setuid-sandbox', '--ignore-certificate-errors'] ... subprocess.Popen(['catt', '-d', device, 'cast', stream_url])
Require user confirmation of the selected title, stream source, and Chromecast device; avoid disabling browser protections unless strictly necessary; and remove the hard-coded server.
Users may need to install required tools manually, which can introduce version or provenance risk.
The metadata does not declare or pin the required runtime tools even though SKILL.md and the script depend on Playwright and CATT.
No install spec — this is an instruction-only skill. Required binaries (all must exist): none.
Install Playwright and CATT only from trusted sources, and prefer a future version that declares and pins its dependencies.
Playback on the Chromecast may continue after the agent reports success or stops running.
CATT is started without being awaited or explicitly stopped, so the cast action may outlive the main script flow.
subprocess.Popen(['catt', '-d', device, 'cast', stream_url]) ... await asyncio.sleep(10)
Make sure users know how to stop the cast, and consider adding a cleanup or stop command.