Lidarr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:45 AM UTC
• Version: 1.0.0

Overview

This Lidarr skill is mostly a coherent local API wrapper, but it includes under-described destructive remove/delete actions and insecure credential handling guidance that users should review before installing.

Install only if you are comfortable giving the skill authority to change your Lidarr library, including removing artists and potentially deleting managed media files. Prefer an HTTPS Lidarr URL, use a placeholder-only API key in docs/config templates, restrict the credential file permissions, and require explicit human confirmation before running remove or --delete-files commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Lidarr API Key May Be Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

&2 echo "Configure HTTPS or explicitly enable an insecure local-network override." >&2 exit 1 ;; *) echo "Error: Lidarr URL must use HTTPS." >&2 exit 1 ;; esac ``` 3. If compatibility with HTTP-only local deployments is essential, require an explicit opt-in such as `allowInsecureHttp: true` and display a prominent warning. The secure default should remain HTTPS. 4. Configure TLS directly in Lidarr or place Lidarr behind a trusted HTTPS reverse proxy. Validate certificates normally; do not add `curl --insecure`. 5. Replace the realistic-looking example API key with an unmistakable placeholder to prevent accidental reuse or confusion: ```json "apiKey": "REPLACE_WITH_YOUR_LIDARR_API_KEY" ``` 6. Document restrictive permissions for the credential file: ```bash chmod 600 ~/.clawdbot/credentials/lidarr/config.json ``` 7. Rotate any API key that may previously have been transmitted over an untrusted plaintext connection, and restrict network access to the Lidarr API using firewall rules or network segmentation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says it searches and adds music, but the script also supports removing artists and optionally deleting their files. This violates the declared scope and creates a dangerous capability gap: an agent or user invoking the skill may reasonably expect non-destructive behavior while the script can perform irreversible destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Optional file deletion is a destructive capability not justified by a skill presented as searching and adding music. In an agent setting, hidden delete functionality materially increases risk because a caller may authorize the skill for discovery/import tasks without intending to grant destructive filesystem-adjacent operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes shell commands throughout the documentation but does not declare any tool scope such as permissions or allowed-tools. That mismatch can cause the agent or user to grant broader execution capability than the manifest communicates, weakening reviewability and increasing the chance of unintended command execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The setup instructs users to persist a long-lived API key in a local credentials file under the home directory. While common, this creates exposure if the file permissions are weak, the workstation is shared, or other tools can read that path, potentially allowing unauthorized control of the Lidarr instance.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Setup

Create ~/.clawdbot/credentials/lidarr/config.json:

json

{
  "url": "http://192.168.1.50:8686",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes the skill as searching and adding music, but the documentation also exposes removal, refresh, and broader library-management operations. This scope drift is dangerous because users and automated policy checks may approve the skill for low-risk search/add use while it actually supports destructive or state-changing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation includes a command that can delete files (remove <artistId> --delete-files) without an explicit warning about irreversible data loss. In an agent setting, this raises the risk that a user or model executes the destructive variant without understanding the consequence, leading to permanent media deletion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes searching and adding music, but this code also changes album monitoring state and can trigger search activity against the remote service. While less severe than deletion, it still performs state-changing actions outside the apparent read/add-only scope, increasing the chance of unintended modification by an agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lidarr.sh (reported line 120)May include surrounding context.

sh

end
    ')
    
    result=$(curl -s -X PUT -H "$AUTH" -H "Content-Type: application/json" -d "$updatePayload" "$API/album/$albumId")
    
    if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
      title=$(echo "$result" | jq -r '.title')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lidarr.sh (reported line 190)May include surrounding context.

sh

end
    ')
    
    result=$(curl -s -X PUT -H "$AUTH" -H "Content-Type: application/json" -d "$updatePayload" "$API/album/$albumId")
    
    if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
      title=$(echo "$result" | jq -r '.title')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lidarr.sh (reported line 257)May include surrounding context.

sh

}
    ')
    
    result=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d "$addRequest" "$API/artist")
    
    if echo "$result" | jq -e '.id' > /dev/null 2>&1; then
      artistName=$(echo "$result" | jq -r '.artistName')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lidarr.sh (reported line 304)May include surrounding context.

sh

artistName=$(echo "$artist" | jq -r '.artistName')
    
    curl -s -X DELETE -H "$AUTH" "$API/artist/$artistId?deleteFiles=$deleteFiles" > /dev/null
    
    if [ "$deleteFiles" = "true" ]; then
      echo "🗑️ Removed: $artistName + deleted files"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script issues a DELETE request immediately, and when --delete-files is set it can remove library entries and associated files without any confirmation, preview, or safety interlock. This makes accidental invocation, parameter mixups, or agent misuse more likely to cause irreversible loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.