Tsarr

• Risk level: Low
• Analyzed: Apr 15, 2026, 1:54 PM
• Findings: 0
• Version: 1.0.3

Overview

The skill is internally consistent: it documents and uses the tsarr CLI, declares the expected config files and a node/npm install, and does not request unrelated credentials or suspicious operations.

This skill appears to be what it claims: a wrapper around the tsarr CLI. Before installing, verify you trust the npm package and its GitHub source (check the package page, repository, and any postinstall scripts). Be aware that the skill expects and may read .tsarr.json and ~/.config/tsarr/config.json (these files often contain API keys and qBittorrent credentials) and supports TSARR_* environment variables — avoid storing secrets you don't want the agent to access. If you prefer more control, install and inspect the tsarr CLI yourself and run the commands manually, or review the package repository for unexpected scripts before granting the skill access.