tsarr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.6

Overview

The skill is coherent for managing home media services, but it should be reviewed because it installs an unpinned executable CLI and documents powerful service mutation commands with uneven warnings.

Install this only if you trust the current and future `tsarr` npm package and are comfortable giving it credentials for your media services. Before destructive operations, require the agent to list or fetch the target first and explicitly confirm actions that delete media, remove torrents with files, approve or decline requests, change watched state, control playback sessions, or start/stop Jellyfin tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–16
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: tsarr
    bins:
      - tsarr

Technical Analysis

The skill declares tsarr as an automatically installable npm dependency without specifying an exact version or integrity hash. Consequently, installation may resolve to a mutable future package release rather than the version that existed when the skill was audited.

The configured GitHub homepage does not cryptographically bind the installed npm artifact to reviewed source code. If the package, maintainer account, publishing credentials, or distribution channel is compromised, a malicious release could execute package lifecycle code during installation or malicious runtime code when the skill invokes tsarr.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or its publishing credentials.
2. The attacker publishes a malicious version under the legitimate tsarr package name.
3. OpenClaw resolves and installs the unpinned package version while satisfying the declared dependency.
4. Malicious installation hooks or runtime logic execute with the privileges of the agent process.
5. The payload accesses local files or environment variables available to that process, potentially including TsArr configuration and service credentials.
6. The attacker may then interact with configured media services using the exposed credentials and permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user or agent installing and running the dependency. The accessible scope may include:

• Local TsArr configuration files.
• API keys for configured Radarr, Sonarr, Lidarr, Readarr, Prowlarr, Bazarr, Seerr, or Jellyfin services.
• qBittorrent credentials.
• Media-library management operations.
• Torren ...[truncated 351 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin tsarr to an exact, reviewed package version rather than resolving the latest compatible release.
2. Use a lockfile containing registry integrity hashes and enforce immutable or frozen-lockfile installation.
3. Verify npm package provenance and compare the published artifact with a trusted, signed source release.
4. Disable npm lifecycle scripts during installation where the package supports operation without them.
5. Perform dependency upgrades only after reviewing source changes, transitive dependencies, and package metadata.
6. Install and execute the CLI under a dedicated least-privileged account or sandbox.
7. Restrict filesystem access to only the required configuration files and prevent access to unrelated secrets.
8. Scope service credentials to the minimum required permissions and rotate them if dependency compromise is suspected.
9. Apply outbound network restrictions where practical so the CLI can reach only explicitly configured media services and trusted package registries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The cheatsheet includes tsarr qbit torrents delete --hashes <hash> --delete-files, which permanently removes torrent data, but it does not warn that --delete-files deletes downloaded files from disk. In an agent skill, concise command examples can be copied or auto-selected without the user appreciating the destructive effect, increasing the chance of unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section documents multiple Jellyfin mutation and control commands, including deleting items, changing watched state, modifying playlists/collections, and controlling active sessions, without clearly flagging them as state-changing or potentially disruptive. In the context of an agent skill for operational use, these examples can enable unintended service disruption, privacy impact, or destructive changes if an agent follows them mechanically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The Seerr section documents approval and decline commands that alter request workflow state, but does not warn that these commands perform mutations rather than read-only inspection. For markdown skill docs, state-changing actions should be clearly distinguished from safe inspection commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.