arr-all

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:26 PM UTC
• Version: 1.0.0

Overview

This is a coherent media-management skill, but it can remove library entries and potentially media files without built-in confirmation safeguards.

Install only if you are comfortable letting an agent manage your Radarr, Sonarr, and Lidarr libraries. Treat remove commands as destructive, keep API-key config files private with restrictive permissions, and avoid running this skill as an elevated user.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/arr-all-calendar.sh:19

Finding

Predictable Temporary Files Permit Symlink-Based File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/arr-all-calendar.sh:19-30, 37-40, 47-50, 74
Vulnerability Type: Insecure predictable temporary-file creation
Risk Level: Medium

Vulnerable Code

bash

# Temp file for aggregating results
TMP_CAL="/tmp/arr-all-calendar-$$.json"
echo "[]" > "$TMP_CAL"

# RADARR
if load_config "radarr"; then
    res=$(api_request "radarr" "GET" "/api/v3/calendar?start=$START_DATE&end=$END_DATE")
    echo "$res" | jq '[.[] | {date: (.inCinemas // .physicalRelease // .digitalRelease // .status), type: "[M]", title: "\(.title) (\(.year))", hasFile: .hasFile, sortKey: (.inCinemas // .physicalRelease // .digitalRelease // .status)}]' > "${TMP_CAL}.radarr"
    jq -s '.[0] + .[1]' "$TMP_CAL" "${TMP_CAL}.radarr" > "${TMP_CAL}.tmp" && mv "${TMP_CAL}.tmp" "$TMP_CAL"
    rm "${TMP_CAL}.radarr"
fi

# SONARR
if load_config "sonarr"; then
    res=$(api_request "sonarr" "GET" "/api/v3/calendar?start=$START_DATE&end=$END_DATE&includeSeries=true")
    echo "$res" | jq '[.[] | {date: .airDate, type: "[TV]", title: "\(.series.title // "Unknown") S\(.seasonNumber)E\(.episodeNumber) - \(.title // "TBA")", hasFile: .hasFile, sortKey: .airDate}]' > "${TMP_CAL}.sonarr"
    jq -s '.[0] + .[1]' "$TMP_CAL" "${TMP_CAL}.sonarr" > "${TMP_CAL}.tmp" && mv "${TMP_CAL}.tmp" "$TMP_CAL"
    rm "${TMP_CAL}.sonarr"
fi

# LIDARR
if load_config "lidarr"; then
    res=$(api_request "lidarr" "GET" "/api/v1/calendar?start=$START_DATE&end=$END_DATE")
    echo "$res" | jq '[.[] | {date: .releaseDate, type: "[Music]", title: "\(.artist.artistName) - \(.title)", hasFile: (.grabbed or .hasFile), sortKey: .releaseDate}]' > "${TMP_CAL}.lidarr"
    jq -s '.[0] + .[1]' "$TMP_CAL" "${TMP_CAL}.lidarr" > "${TMP_CAL}.tmp" && mv "${TMP_CAL}.tmp" "$TMP_CAL"
    rm "${TMP_CAL}.lidarr"
fi

# Later cleanup
rm "$TMP_CAL"

Technical Analysis

The calendar script constructs temporary paths in the shared /tmp directory using the process ID. Process IDs are predictabl ...[truncated 2131 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a private temporary directory atomically:

bash

umask 077
TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/arr-all-calendar.XXXXXX") || {
    echo "Failed to create temporary directory" >&2
    exit 1
}
trap 'rm -rf -- "$TMP_DIR"' EXIT INT TERM HUP

TMP_CAL="$TMP_DIR/calendar.json"
RADARR_CAL="$TMP_DIR/radarr.json"
SONARR_CAL="$TMP_DIR/sonarr.json"
LIDARR_CAL="$TMP_DIR/lidarr.json"
MERGED_CAL="$TMP_DIR/merged.json"

printf '%s\n' '[]' > "$TMP_CAL"

2. Place every intermediate file inside that private directory rather than constructing adjacent predictable paths.
3. Preserve umask 077 while sensitive temporary files are created so only the current user can access them.
4. Use a cleanup trap to remove temporary data on success, error, or interruption.
5. Abort immediately if temporary-file or directory creation fails.
6. Do not run the Skill under a privileged account unless strictly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The remove function issues a DELETE request with a caller-controlled deleteFiles flag and performs the operation immediately, without any user-facing confirmation, dry-run, or secondary safeguard. In this skill’s media-management context, that can lead to accidental irreversible deletion of movie files and library state from automation, scripts, or mistaken inputs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents shell-based command capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where an agent or runtime may permit broader shell execution than users expect, increasing the chance of unintended command execution through this skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill instructs users to persist API keys in local credential files under the home directory, which creates a session-persistence and secret-at-rest exposure risk if file permissions are weak, backups are exposed, or other local processes can read them. While common for CLI integrations, storing long-lived service credentials locally still expands the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

You can use a unified config file or existing individual configs.

Unified Config (Preferred): Create ~/.openclaw/credentials/arr-all/config.json:

json

{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented remove command includes an option to delete media files, but the skill does not provide an explicit warning about destructive consequences or recommend confirmation safeguards. In an agent-driven context, this raises the risk of accidental irreversible deletion of user data if a remove action is invoked incorrectly or with broad assumptions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/common.sh (reported line 87)May include surrounding context.

sh

fi
    fi

    # Safe curl command construction
    if [[ -n "$data" ]]; then
        curl -s -X "$method" "$URL$endpoint" -H "X-Api-Key: $API_KEY" -H "Content-Type: application/json" -d "$data"
    else

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The function sends HTTP requests with an API key header and optional JSON payload via curl, but there is no confirmation prompt, user-facing log, or warning near the operation. Because this code transmits credentials and potentially user/system data over the network, it meets the missing-disclosure criteria for code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The remove function issues a Sonarr DELETE request immediately based on a TVDB ID and optional deleteFiles flag, with no built-in confirmation, dry-run, or preview of the target before destruction. In this skill’s context, that can remove an existing series from the managed library and may also delete underlying media files, making accidental or misrouted invocations operationally damaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script makes multiple HTTP API requests to Radarr, Sonarr, and Lidarr and processes returned release information, but it provides no comment, prompt, or user-facing notice that it will contact external services and retrieve library-related metadata. Although the script prints output, that output does not disclose the network activity itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.