TorrentClaw
v0.1.17Search and download torrents via TorrentClaw. Use when the user asks to find, search, or download movies, TV shows, or torrents. Detects local torrent client...
⭐ 1· 742·0 current·0 all-time
by@buryni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description, declared binaries (curl, bash, jq), and included scripts (detect-client, add-torrent, install-guide) are consistent with a torrent search/download skill. The only mismatch: registry metadata marks TORRENTCLAW_API_KEY as a required env var / primary credential, while SKILL.md explicitly states the API key is optional (anonymous use allowed). That inconsistency is unexplained.
Instruction Scope
SKILL.md stays within the stated purpose: it instructs the agent to detect local torrent clients, call the TorrentClaw API, present results, and add magnets or provide torrent files. It does reference local system state (detects installed clients, may call transmission-remote or localhost aria2 RPC) which is expected for the feature. It also instructs adding an 'x-search-source: skill' header (telemetry/analytics) — notable but consistent with the described API.
Install Mechanism
No external install step is provided (instruction-only skill). All included scripts are plain shell, readable, and not obfuscated. No downloads from untrusted URLs or archive extraction are present in the skill bundle itself.
Credentials
The only credential requested is TORRENTCLAW_API_KEY, which is appropriate for an API-backed search service — but the metadata marks it required while the runtime docs say the key is optional (anonymous rate-limited access). This contradictory requirement is concerning: the skill should not force users to provide a secret if anonymous mode is supported. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request permanent or global presence (always:false). It runs local scripts when invoked and may start background aria2 processes, but it does not modify other skills or system-wide agent settings.
What to consider before installing
This skill appears to do what it says: search an external TorrentClaw API and add magnet links to local torrent clients. Two things to consider before installing: (1) metadata vs documentation mismatch — the registry marks TORRENTCLAW_API_KEY as required but SKILL.md says the key is optional; ask the publisher which is true and only supply your API key if you trust the service. (2) The skill sends requests to https://torrentclaw.com and adds an x-search-source header for analytics, and its add-torrent script will interact with local daemons (transmission/aria2) and may start background aria2 processes — only install if you trust those network interactions and understand legal/privacy implications of torrenting. If you want lower risk, install but do not set TORRENTCLAW_API_KEY (use anonymous mode) and review/limit the skill's access to local clients or run it in an isolated environment. If you need higher assurance, ask the publisher for a signed release or a canonical repository URL and clarification about the API-key requirement.Like a lobster shell, security has layers — review code before you run it.
latestvk97b7ryn6ad2j8xynzw0aj5g6d818s49securityvk97b7ryn6ad2j8xynzw0aj5g6d818s49
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎬 Clawdis
OSmacOS · Linux · Windows
Binscurl, bash, jq
EnvTORRENTCLAW_API_KEY
Primary envTORRENTCLAW_API_KEY