Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

emby-manager

v1.0.0

管理运行在 Linux NAS 上的 Emby 媒体服务器。当用户提到 Emby、媒体库、NAS 娱乐管理、刮削元数据、查看播放记录、管理用户权限、检查服务器状态等任何与 Emby 相关的操作时,必须使用此 Skill。即使用户只是问"帮我看看 Emby 状态"、"媒体库扫描一下"、"谁在看片"这类口语化表达,也...

0· 87·0 current·0 all-time
by六面体@gmd170629

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for gmd170629/emby-manager.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "emby-manager" (gmd170629/emby-manager) from ClawHub.
Skill page: https://clawhub.ai/gmd170629/emby-manager
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install emby-manager

ClawHub CLI

Package manager switcher

npx clawhub@latest install emby-manager
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill name/description (Emby management) matches the instructions and reference docs: API endpoints, library operations, user/permission management, sessions, logs, and troubleshooting. It does not request unrelated credentials, binaries, or config paths.
Instruction Scope
Instructions expect the agent to ask the user for the Emby server address and API key and then perform API calls (GET/POST/DELETE) and present structured results. The docs also include Linux system commands (systemctl, sudo, ufw, chown, journalctl) as optional troubleshooting steps when the user can run them or has SSH access. The skill instructs the agent to 'remember' the API key for the duration of the conversation — this is reasonable for session use but increases sensitivity of what the agent holds in memory.
Install Mechanism
No install spec and no code files that would be written to disk; instruction-only skills have minimal installation risk.
Credentials
The skill requests only the Emby server address and API key at runtime (declared in SKILL.md). No additional environment variables, system credentials, or unrelated tokens are requested. The API key is reasonable for the described operations but is a high-privilege secret for the Emby instance.
Persistence & Privilege
always is false and the skill is user-invocable. There is no instruction to modify other skills or global agent configuration. The only persistence implied is conversational memory of the provided server address and API key during the session.
Assessment
This skill appears to do what it says: manage an Emby server via its API. Before providing an API key, consider: 1) only supply it to a trusted agent instance and over an encrypted connection (use https and local network access where possible); 2) prefer creating a scoped or temporary API key if Emby supports it and avoid sharing root/SSH credentials; 3) be aware that API keys grant control over media, users, and logs — treat them as sensitive and rotate them if exposed; 4) confirm destructive actions (deleting items, modifying user policies) before executing and never run system-level sudo commands unless you understand them; 5) avoid pasting full logs that might contain other secrets or personal data. If you want additional certainty, request the skill author/source or run the interactions in a sandboxed/test Emby instance first.

Like a lobster shell, security has layers — review code before you run it.

latestvk974v1f6s0mjkc1hp77mamzjhs83qfjw
87downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Emby 媒体服务器管理 Skill

首次使用:获取连接信息

如果对话中没有服务器地址和 API Key,必须先向用户索取

请提供以下信息:
1. Emby 服务器地址(如 http://192.168.1.100:8096)
2. API Key(在 Emby 后台:Dashboard → Advanced → API Keys → 新建)

获取后,在整个对话中记住这两个值,不要重复询问。


标准 API 调用格式

// 所有请求统一使用此格式
const BASE = "http://<server>:<port>"  // 用户提供
const API_KEY = "<api_key>"            // 用户提供

// GET 请求
fetch(`${BASE}/endpoint?api_key=${API_KEY}`)

// POST 请求
fetch(`${BASE}/endpoint?api_key=${API_KEY}`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({...})
})

详细 API 端点速查 → 阅读 references/api-guide.md


四大功能模块

1. 媒体库管理

触发词:扫描、刷新、刮削、元数据、整理、媒体库

工作流程:

  1. 先调用 GET /Library/MediaFolders 列出所有媒体库
  2. 根据用户意图选择操作(全库扫描 / 单库刷新 / 刮削元数据)
  3. 触发操作后,告知用户任务已提交,可通过计划任务接口查看进度

常用操作速查:

操作方法端点
全库扫描POST/Library/Refresh
查看媒体库列表GET/Library/MediaFolders
刷新单个条目元数据POST/Items/{itemId}/Refresh
查看计划任务状态GET/ScheduledTasks
运行指定计划任务POST/ScheduledTasks/Running/{taskId}

完整操作细节 → 阅读 references/media-ops.md


2. 用户与权限管理

触发词:用户、账号、权限、谁能看、新增用户、禁用

工作流程:

  1. GET /Users 获取所有用户列表
  2. 按需查看/修改单个用户:GET /Users/{userId}
  3. 修改权限时使用 POST /Users/{userId}/Policy

展示用户信息时,重点呈现:用户名、是否管理员、是否禁用、最后活跃时间


3. 播放记录与统计查询

触发词:播放记录、谁在看、最近看了什么、观看历史、活跃会话

工作流程:

  1. 实时会话GET /Sessions — 查看当前正在播放的内容
  2. 播放活动GET /user_usage_stats/user_activity(需 Emby Stats 插件)
  3. 最近播放GET /Users/{userId}/Items/Latest
  4. 媒体统计GET /Items/Counts

展示会话信息时,重点呈现:用户名、正在播放的内容、播放进度、客户端类型、IP 地址


4. 服务器监控与健康检查

触发词:状态、健康、监控、性能、内存、CPU、转码、日志

工作流程:

  1. GET /System/Info — 获取服务器基本信息(版本、操作系统、内存)
  2. GET /Sessions — 查看活跃连接数和转码任务
  3. GET /ScheduledTasks — 查看后台任务队列
  4. GET /System/Logs — 获取最新日志列表

健康检查时,综合呈现:

  • 服务器版本 & 运行时间
  • 当前活跃会话数 / 转码流数量
  • 系统内存使用情况
  • 是否有失败的计划任务

排查问题时 → 阅读 references/troubleshoot.md


输出规范

  • 数据以表格或结构化列表呈现,不要直接 dump JSON
  • 操作完成后,说明下一步可以做什么
  • 涉及破坏性操作(删除、修改权限)时,先向用户确认
  • API 调用失败时,给出具体错误原因并引导排查

快速参考

媒体库相关  → references/api-guide.md#媒体库
用户相关    → references/api-guide.md#用户
统计相关    → references/api-guide.md#统计
排查问题    → references/troubleshoot.md

Comments

Loading comments...