clawd qBittorrent

This skill is basically a qBittorrent WebUI client implemented as a shell script and is coherent with its stated purpose, but review these before installing: - Verify the credentials path: SKILL.md and README disagree (~/.openclaw vs ~/.clawdbot). Make sure you create the credentials file where the script will actually read it (or set QBIT_CONFIG). - Ensure required tools exist: the script uses curl and jq; install those or the script will fail. The registry metadata did not declare required binaries. - Protect credentials: the script reads username/password in plaintext from a JSON file or env vars—store that file with appropriate permissions and consider using env vars if you prefer not to keep a file. - Be cautious about QBIT_URL: only point it to qBittorrent instances you trust and control (ideally local or private network). The add-file command uploads local files to the remote qBittorrent instance, which could leak file contents if the remote server is untrusted. - Check the cookie file location (/tmp/qbit_cookie_<uid>.txt) and its permissions; it contains session identifiers. - If you need higher assurance, open and review scripts/qbit-api.sh fully (it is included) and test in a controlled environment before granting access to sensitive torrents or exposing to public hosts. Given the mismatches and sensitive plaintext credentials, proceed only after confirming these items; the issues look like sloppy configuration rather than intentionally malicious behavior.