qBittorrent Skill

Manage torrents with qBittorrent. Use when the user asks to "list torrents", "add torrent", "pause torrent", "resume torrent", "delete torrent", "check downl...

Security Scan

The skill's code implements qBittorrent WebUI control as described, but its documentation, declared requirements, and credential handling are inconsistent and under-specified — proceed only after addressing these mismatches and securing credentials.

Purpose & Capability

The script and docs implement qBittorrent WebUI API calls (list, add, pause, resume, delete, speed limits, etc.), which matches the skill's stated purpose. However the package metadata declares no required binaries or credentials while the runtime requires curl, jq, and qBittorrent credentials, so the manifest does not fully reflect the actual capabilities needed.

Instruction Scope

SKILL.md / README instruct the agent/user to create a local JSON credentials file (or set env vars) containing the qBittorrent URL, username, and password; the script will read that file and use it to authenticate and control the WebUI. There are conflicting paths in the docs (SKILL.md uses ~/.openclaw/...; README uses ~/.clawdbot/...) which is confusing. Storing plaintext credentials in a home directory file and writing a session cookie to /tmp are explicit behaviors the skill asks for and should be called out.

Install Mechanism

This is an instruction-only skill with no install spec, so nothing is downloaded or written by an installer. The script runs locally and uses standard CLI tools; no remote install URLs are present.

Credentials

The registry lists no required env vars or primary credential, but the runtime expects qBittorrent credentials (via config file or QBIT_URL/QBIT_USER/QBIT_PASS env vars) and relies on curl and jq. The skill should declare these dependencies and the fact that it needs the user's qBittorrent username/password. Asking for those credentials is proportionate to the stated purpose, but the lack of explicit declaration and the plaintext-storage guidance are problematic.

Persistence & Privilege

The skill does not request persistent platform-level privileges or set always:true. It creates/reads a per-user credentials file and writes a session cookie to /tmp, which is a modest local persistence limited to the user's environment and is consistent with a WebUI client.

What to consider before installing

This skill appears to do what it says (control qBittorrent via its WebUI API), but there are several mismatches and things to check before installing: - Missing declared dependencies: the script uses curl and jq (and standard shell tools). Ensure those binaries are present; the skill metadata does not list them. - Config path inconsistency: SKILL.md, README, and the script reference different credential paths (~/.openclaw/... vs ~/.clawdbot/...). Confirm which path you must use or set QBIT_CONFIG to point to your file. - Credentials handling: the skill expects your qBittorrent username/password in a local JSON file or env vars. That means the agent/script will have full control over your torrents (including deleting files). If you proceed, store credentials with restrictive permissions (chmod 600) or prefer env vars and avoid leaving plaintext in shared locations. - Session cookie: the script writes a cookie file to /tmp; consider the transient exposure of that file on multi-user systems. - Network exposure: the skill will send commands to whatever QBIT_URL you provide. Ensure the qBittorrent WebUI is appropriately firewalled/whitelisted so credentials aren't usable remotely by other hosts. If you want to proceed, request that the skill author update the manifest to declare required binaries and clearly document the correct config path and credential behavior. If you cannot verify these things, treat the skill as untrusted because it will be able to control and delete torrents when given credentials.

qBittorrent WebUI API

Manage torrents via qBittorrent's WebUI API (v4.1+).

Setup

Config: ~/.openclaw/credentials/qbittorrent/config.json

{
  "url": "http://your-qbit-host:8080",
  "username": "admin",
  "password": "your-password"
}

Quick Reference

List Torrents

# All torrents
./scripts/qbit-api.sh list

# Filter by status
./scripts/qbit-api.sh list --filter downloading
./scripts/qbit-api.sh list --filter seeding
./scripts/qbit-api.sh list --filter paused

# Filter by category
./scripts/qbit-api.sh list --category movies

Filters: all, downloading, seeding, completed, paused, active, inactive, stalled, errored

Get Torrent Info

./scripts/qbit-api.sh info <hash>
./scripts/qbit-api.sh files <hash>
./scripts/qbit-api.sh trackers <hash>

Add Torrent

# By magnet or URL
./scripts/qbit-api.sh add "magnet:?xt=..." --category movies

# By file
./scripts/qbit-api.sh add-file /path/to/file.torrent --paused

Control Torrents

./scripts/qbit-api.sh pause <hash>         # or "all"
./scripts/qbit-api.sh resume <hash>        # or "all"
./scripts/qbit-api.sh delete <hash>        # keep files
./scripts/qbit-api.sh delete <hash> --files  # delete files too
./scripts/qbit-api.sh recheck <hash>

Categories & Tags

./scripts/qbit-api.sh categories
./scripts/qbit-api.sh tags
./scripts/qbit-api.sh set-category <hash> movies
./scripts/qbit-api.sh add-tags <hash> "important,archive"

Transfer Info

./scripts/qbit-api.sh transfer   # global speed/stats
./scripts/qbit-api.sh speedlimit # current limits
./scripts/qbit-api.sh set-speedlimit --down 5M --up 1M

App Info

./scripts/qbit-api.sh version
./scripts/qbit-api.sh preferences

Response Format

Torrent object includes:

• hash, name, state, progress
• dlspeed, upspeed, eta
• size, downloaded, uploaded
• category, tags, save_path

States: downloading, stalledDL, uploading, stalledUP, pausedDL, pausedUP, queuedDL, queuedUP, checkingDL, checkingUP, error, missingFiles