Tsarr

Manage home media services through TsArr from OpenClaw. Use for Radarr, Sonarr, Lidarr, Readarr, Prowlarr, Bazarr, qBittorrent, and Seerr tasks such as check...

Security Scan

The skill is internally consistent: it documents and uses the tsarr CLI, declares the expected config files and a node/npm install, and does not request unrelated credentials or suspicious operations.

Purpose & Capability

Name/description, required binary (tsarr), declared config paths (.tsarr.json, ~/.config/tsarr/config.json), and the install spec (npm package 'tsarr') all align with the stated purpose of managing Servarr apps via the tsarr CLI.

Instruction Scope

SKILL.md and references confine actions to running the tsarr CLI and inspecting/manipulating its config and services. They reference environment variables (TSARR_*) and explicit config files — these are relevant to the tool. Note: the skill references service-specific env vars and config files but does not require them; ensure you are comfortable the agent can read the declared config paths since they may contain API keys.

Install Mechanism

Install uses an npm package ('tsarr') which is appropriate for a Node CLI but carries the usual npm-level risk (packages may include postinstall scripts). No untrusted download URLs or archive extraction are used.

Credentials

The skill does not request credentials in registry metadata, which is reasonable. It does declare config files that may contain service API keys and documents environment variable patterns (TSARR_* and qBittorrent username/password). Access to those config files is proportionate to the skill's purpose, but they can contain sensitive credentials — be aware the agent will read them if needed.

Persistence & Privilege

No 'always: true' or other elevated persistence is requested. The skill is user-invocable and allows normal autonomous invocation (default), which is expected for this kind of integration.

Assessment

This skill appears to be what it claims: a wrapper around the tsarr CLI. Before installing, verify you trust the npm package and its GitHub source (check the package page, repository, and any postinstall scripts). Be aware that the skill expects and may read .tsarr.json and ~/.config/tsarr/config.json (these files often contain API keys and qBittorrent credentials) and supports TSARR_* environment variables — avoid storing secrets you don't want the agent to access. If you prefer more control, install and inspect the tsarr CLI yourself and run the commands manually, or review the package repository for unexpected scripts before granting the skill access.

Manage Servarr apps through the tsarr CLI.

Start

• Verify the CLI is available with tsarr --help.
• If setup or service health is unclear, read references/setup.md and start with tsarr doctor.
• Prefer --json when selecting IDs, extracting fields, or comparing results.

Safety

• Inspect before mutating.
• Fetch the current item before edit or delete when possible.
• Avoid --yes on destructive commands unless the user explicitly wants non-interactive execution.
• If the user says "Arr", "library", or "queue" without naming a service, clarify which service to use.
• If a service has multiple named instances and the user doesn't specify which, clarify or default to the first instance.

Routing

• Read references/setup.md for installation expectations, configuration, and connectivity checks.
• Read references/common-workflows.md for health checks, library browsing, search, add, queue, history, refresh, and delete flows.
• Read references/service-cheatsheet.md to map a user request to the correct service resource action command.

Notes

• Trust the command patterns in these references over stale prose elsewhere.
• Keep responses operational: show the command you plan to run, summarize the result, and call out any destructive effect before you execute it.