ClawShorts

Block YouTube Shorts on Fire TV. Use when asked to check, manage, or configure YouTube Shorts limiting on Buck's Fire TV devices. Triggers on requests like "...

Security Scan

The skill's code matches its stated purpose (blocking YouTube Shorts via ADB) but there are security-relevant inconsistencies and design choices you should understand before installing—most notably a claimed private-IP restriction that isn't consistently enforced and abrupt force-stop behavior without user notification.

Purpose & Capability

Name/description align with the code and required binaries: the skill uses adb + python3 to monitor Fire TV UI and force-stop YouTube when a per-device daily limit is reached. No unrelated cloud credentials or external services are requested.

Instruction Scope

SKILL.md and README claim the tool “only accepts private IP addresses”, but the Python validator (src/clawshorts/validators.py) was audited as only validating octets (0–255) and not enforcing private ranges. Bash helpers include a private-range check, but the authoritative Python path may accept public IPs. The daemon and scripts create files under ~/.clawshorts, install user LaunchAgent/systemd units, run adb commands, and can force-stop apps via ADB—these are expected for the stated purpose, but the mismatch around IP validation and the lack of a user-visible warning/grace period before force-stopping YouTube are problematic.

Install Mechanism

No remote downloads or URL installs; the package is instruction + included code files only. Installation writes files to the user home directory (~/.clawshorts) and can create a symlink in /opt/homebrew/bin and a user LaunchAgent/systemd service. No untrusted network fetches are performed by the daemon according to the audit.

Credentials

The skill requests no environment variables or external credentials (good). It requires adb and python3 and reads/writes only user-owned paths. It does create symlinks under /opt/homebrew/bin (may require privilege/sudo) and manipulates user-level services (launchctl/systemctl) — these are proportional to running a persistent local daemon but worth noting.

Persistence & Privilege

The skill persists as a user-level LaunchAgent/systemd service and includes a health-check sidecar that can kill/restart daemon processes (uses pgrep/pkill/launchctl). 'always' is false; the skill is user-invocable and can be installed to start at login. The control over process lifecycle is broad but confined to the user's account and processes matching 'clawshorts'; however pkill/pgrep usage is somewhat imprecise and could match unintended processes in rare cases.

Scan Findings in Context

[no_private_ip_validation] unexpected: SECURITY_AUDIT.md: src/clawshorts/validators.py validates IPv4 octets but does not enforce private-range checks. SKILL.md explicitly states only private IPs are accepted, so this is an incoherence that could allow attempts to connect to public IPs if the Python path is used.

[adb_no_auth_documented] expected: The audit documents that ADB itself has no authentication; this is inherent to the ADB protocol and expected for a tool that uses adb to control Fire TV. The SKILL.md includes prominent warning text about enabling ADB only on trusted networks.

[force_stop_no_confirmation] expected: The daemon force-stops the YouTube package with 'am force-stop' when limits are reached. That behavior is core to the stated purpose, but the audit flags the lack of a user-visible warning/grace period prior to termination—this is an operational/UX security concern rather than evidence of maliciousness.

[broad_pgrep_usage] expected: Scripts use 'pgrep -f' and 'pkill -f' to find/kill daemon processes; this is expected for process management but can match broader command lines. The audit recommends a PID-file approach for precision.

[sigkill_after_2s] expected: The stop script sends SIGTERM then unconditionally SIGKILL after 2s. This is typical for quick stop scripts but the audit notes better checking would be cleaner.

[ui_xml_no_cleanup] expected: The daemon pulls UI XML dumps to ~/.clawshorts/ui-*.xml and does not clean them up. The audit marks this low-severity (disk accumulation) issue; it's expected given the design.

[daemon_no_resource_limits] expected: LaunchAgent plist does not set resource limits; audit flags potential DOS if daemon misbehaves. This is a configuration hardening issue rather than malicious behavior.

[no_remote_fetch] expected: Audit found no external network fetches (no curl/wget) in the daemon — this is a positive signal and consistent with an offline local-control tool.

What to consider before installing

This skill appears to implement what it claims (blocking YouTube Shorts on Fire TV via ADB) and does not contact external servers or request secrets — but there are important caveats: - ADB is unauthenticated: only enable ADB debugging on a trusted, password-protected home network. Anyone on the same LAN could control a device with ADB enabled. - IP validation mismatch: SKILL.md promises the tool will accept only private IPs, but the Python validator was audited as not enforcing private-range checks. Before installing, either: (a) confirm you will only add private IPs manually, or (b) patch/verify src/clawshorts/validators.py to use ipaddress.ip_address(...).is_private/is_loopback as recommended in SECURITY_AUDIT.md. - Abrupt app termination: the daemon force-stops YouTube without an on-screen warning. If you want gentler behavior, implement a configurable grace/warning period or notification before calling 'am force-stop'. - Installation creates user-level autostart entries and may add a symlink under /opt/homebrew/bin (may require elevated privileges). Review the LaunchAgent/systemd unit before enabling and consider adding resource limits to the plist/service. If you decide to proceed: run the code in a test environment first, review/patch the validator to enforce private IPs, enable debug logging to observe behavior, and keep ADB disabled when not actively using the tool.

YouTube Shorts limiter for Fire TV. Monitors watch time per device and auto-blocks when daily limit is reached.

Invocation

Primary entry point:

~/.openclaw/workspace/skills/clawshorts/scripts/clawshorts.sh <command>

Commands

Command	When to use
status	Check today's usage, remaining quota, daemon health
reset [IP]	Reset today's counter (all devices or specific IP)
start	Start the daemon if not running
stop	Stop the daemon
history [days]	Show watch history (default 30 days)
logs [N]	Show last N daemon log lines (default 50)
list	List all configured devices with per-device config
setup <IP> [NAME]	First-time setup for a new device
add <IP> [NAME]	Add another Fire TV
connect <IP>	Connect ADB to device + auto-detect screen
enable <IP> / disable <IP>	Enable/disable a device
config [show|get|set|reset]	View/set global or per-device config
detect <IP>	Re-detect screen resolution via ADB, update DB

Detection Logic

Detection requires both conditions to be true simultaneously:

1. Player width < 30% of screen width (configurable per-device)
2. Aspect ratio < 1.3 (portrait — distinguishes Shorts from 16:9 landscape previews)

• Poll interval: 3 seconds via ADB
• Shorts: ~32% screen width, 9:16 portrait (ar ~0.56)
• Regular video: ~100% screen width, 16:9 landscape (ar ~1.78)
• Home/browse: no video active
• Only actual Shorts playback counts toward limit

Configuration

All detection parameters are stored in SQLite with global defaults and per-device overrides.

Global defaults (shorts config):

key	default	description
shorts_width_threshold	0.30	player width must be < this ratio of screen width
shorts_max_aspect_ratio	1.3	portrait if ar < this value
shorts_fallback_height_ratio	0.4	fallback: player height must exceed this ratio of screen height
shorts_delta_cap	300	max seconds accumulated per poll
default_screen_width	1920	fallback assumed screen width
default_screen_height	1080	fallback assumed screen height

Per-device overrides — any of the above can be set per-device in the devices table. NULL = use global default.

Config commands:

shorts config                    # show all global defaults
shorts config get <key>         # get a specific value
shorts config set <key> <value> # set global default
shorts config set <IP> <col> <value>  # set per-device override
shorts config reset <IP>        # clear per-device overrides
shorts detect <IP>              # re-detect screen via ADB

Data Locations

• Database: ~/.clawshorts/clawshorts.db (SQLite)
  • config — global detection defaults
  • devices — per-device settings (IP, name, limit, screen size, thresholds)
  • daily_usage — daily watch time per device
• Daemon log: ~/.clawshorts/daemon.log
• LaunchAgent: ~/Library/LaunchAgents/com.fink.clawshorts.plist

Requirements

• adb (Android platform tools)
• Python 3
• Fire TV with ADB debugging enabled
• shorts symlink at /opt/homebrew/bin/shorts (optional)

⚠️ Security Notes

ADB has no built-in authentication. Only enable ADB Debugging on a trusted, password-protected home network. Never on public WiFi. Anyone on the same network with ADB enabled can connect to your Fire TV.

This tool only accepts private IP addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x). Public IPs are rejected to prevent accidental targeting of unrelated hosts.