Tsarr

Manage home media services through TsArr from OpenClaw. Use for Radarr, Sonarr, Lidarr, Readarr, Prowlarr, and Bazarr tasks such as checking health, inspecti...

Security Scan

This skill is internally coherent: it wraps the tsarr CLI, requests the tsarr binary (or installs the tsarr npm package), and operates on tsarr configuration files as expected for a CLI helper.

Purpose & Capability

Name/description, declared binaries, required config paths, and the install spec (npm package 'tsarr' producing a 'tsarr' binary) all align with a CLI wrapper for Servarr apps. No unrelated credentials, binaries, or services are requested.

Instruction Scope

SKILL.md and reference files instruct only to run tsarr commands, inspect or edit tsarr configuration, and use tsarr health/doctor flows. They explicitly recommend inspection before destructive actions and do not direct reading of unrelated system files or exfiltration to third-party endpoints.

Install Mechanism

Install uses the Node/npm package 'tsarr' (creates a 'tsarr' CLI). This is a common/expected install path for a Node CLI, but installing packages from registries writes code to disk and should be done from a trusted source (verify the package and maintainers).

Credentials

The skill declares no required environment variables. The documentation notes optional TSARR_{SERVICE}_URL and TSARR_{SERVICE}_API_KEY patterns (reasonable for configuring services). The only required config paths are tsarr's own config files, which is proportionate to the stated purpose.

Persistence & Privilege

always:false and user-invocable:true (normal). The skill does not request elevated system-wide privileges or modify other skills; its persistence is limited to installing/using the tsarr CLI and reading/writing tsarr config files.

Assessment

This skill appears to do what it claims, but before installing: 1) Verify the npm package 'tsarr' and its maintainer (the homepage is the GitHub repo listed) to avoid a malicious package with the same name. 2) Be aware the skill will read/write tsarr config files (~/.config/tsarr/config.json and .tsarr.json) which may contain service URLs and API keys—inspect those files and avoid storing unrelated secrets there. 3) Follow the skill's own advice: inspect (get/list) before using delete/edit and avoid --yes unless you want non-interactive destructive changes. 4) If you prefer extra safety, install and run the tsarr CLI in a confined environment (container or dedicated host) before allowing the skill to run it automatically.

Manage Servarr apps through the tsarr CLI.

Start

• Verify the CLI is available with tsarr --help.
• If setup or service health is unclear, read references/setup.md and start with tsarr doctor.
• Prefer --json when selecting IDs, extracting fields, or comparing results.

Safety

• Inspect before mutating.
• Fetch the current item before edit or delete when possible.
• Avoid --yes on destructive commands unless the user explicitly wants non-interactive execution.
• If the user says "Arr", "library", or "queue" without naming a service, clarify which service to use.

Routing

• Read references/setup.md for installation expectations, configuration, and connectivity checks.
• Read references/common-workflows.md for health checks, library browsing, search, add, queue, history, refresh, and delete flows.
• Read references/service-cheatsheet.md to map a user request to the correct service resource action command.

Notes

• Trust the command patterns in these references over stale prose elsewhere.
• Keep responses operational: show the command you plan to run, summarize the result, and call out any destructive effect before you execute it.