ClawHub
Back to skill

Security audit

MovieFetch

Security checks for vulnerabilities and agentic risk

Overview

MovieFetch mostly matches its media-automation purpose, but it needs review because a chat-triggered remove action can delete media files by default without a clear confirmation step.

Install only if you are comfortable giving the skill control over your Plex/Radarr/qBittorrent stack. Before using it, make file deletion explicitly opt-in and confirmed, avoid ambiguous movie titles, and use credentials limited to trusted local service URLs.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'RADARR_URL' from os.environ.get (line 13, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"indexerId": best_release["indexerId"],
        "movieId": movie_id
    }
    dl_resp = requests.post(
        f"{RADARR_URL}/release",
        headers={**HEADERS, "Content-Type": "application/json"},
        json=dl_payload,
Confidence
73% confidence
Finding
The POST target is built from RADARR_URL taken directly from the environment, so if that environment variable is altered, the skill will send authenticated requests and operational data to an attacker-controlled endpoint. In an agent or multi-tenant deployment, this creates SSRF-style risk and potential API key disclosure to an untrusted server.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and orchestrates scripts that require network access and likely environment-based secrets, but it declares no permissions. This creates a transparency and policy-enforcement gap: reviewers and runtime controls may underestimate what the skill can access, increasing the chance of over-privileged or unmonitored execution against Plex, Radarr, and qBittorrent services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior is narrower than the detected code capabilities: checking OTT providers via TMDB and listing all qBittorrent torrents expands data access beyond a single requested movie's lifecycle. This mismatch is dangerous because hidden or undocumented functionality reduces informed consent and review quality, and listing all torrents can expose unrelated downloads, media interests, or operational metadata to users who only asked for a specific movie status.

Static analysis

No suspicious patterns detected.