ClawHub
Back to skill

Security audit

Request media on Overseerr

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but one documented TV-season request can submit the same authenticated request twice.

Review before installing. The integration is otherwise straightforward, but the TV season request example should be fixed to include only one request endpoint, and users should be comfortable sending media search and request data to their configured Overseerr service using the provided API key.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:116
Finding

Duplicate Authenticated POST Request in TV Season Example

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116–122
Vulnerability Type: Duplicate state-changing API request caused by an extra URL operand
Risk Level: Medium

sh
curl -s -X POST \
-H "X-Api-Key: $OVERSEERR_API_KEY" \
-H "Content-Type: application/json" \
"$OVERSEERR_URL/api/v1/request" \
"$OVERSEERR_URL/api/v1/request" \
-d '{"mediaType":"tv","mediaId":71912,"seasons":[2]}'

Technical Analysis

The curl command supplies the same request endpoint twice. curl processes multiple URL operands as separate transfers, while the POST method, authentication header, content type, and request body apply to both transfers. Following this documented example can therefore send two identical authenticated, state-changing requests to Overseerr.

This behavior contradicts the skill's duplicate-prevention workflow. Although Overseerr may reject the second request, the command cannot safely rely on server-side deduplication. The use of -s also suppresses progress and error details, potentially making the duplicate operation less apparent to the user or agent.

Attack Path

  1. A user asks the skill to request a specific television season.
  2. The agent follows the documented TV season example.
  3. curl processes both identical URL operands.
  4. Two authenticated POST /api/v1/request operations are sent with the same media and season data.
  5. If the server or downstream integrations do not enforce atomic deduplication, both operations may trigger request processing or related side effects.

Impact Assessment

The issue does not grant an attacker additional privileges beyond those already associated with OVERSEERR_API_KEY. Its scope is limited to the configured Overseerr instance and connected media-management workflows.

Potential consequences include duplicate media requests, repeated notifications, duplicate downstream Sonarr or Radarr actions, unnecessary API usage, rate-limit c ...[truncated 149 chars]

Remediation
View remediation

Remediation Suggestions

Remove the duplicate URL operand so the command performs exactly one state-changing request:

sh
curl --fail-with-body -sS -X POST \
  -H "X-Api-Key: $OVERSEERR_API_KEY" \
  -H "Content-Type: application/json" \
  "$OVERSEERR_URL/api/v1/request" \
  -d '{"mediaType":"tv","mediaId":71912,"seasons":[2]}'

Additionally:

  1. Check the media's availability and request status before submitting the request.
  2. Validate the HTTP status and response body rather than assuming the operation succeeded.
  3. Handle duplicate-request responses explicitly and report them as already requested.
  4. Use an idempotency mechanism if supported by the API.
  5. Add automated documentation or command tests that verify each mutation example contains exactly one endpoint operand.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill performs an action on the user's self-hosted Overseerr instance that can trigger downstream Sonarr/Radarr automation, but the description does not clearly warn the user that their request will be transmitted to an external service and may initiate media acquisition workflows. This is a real transparency and consent issue because users may not realize the scope of the action beyond a simple lookup.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill sends user-provided media titles to an external Overseerr endpoint using an API key, which constitutes external data transmission. In context this is expected functionality, but it is still security-relevant because potentially sensitive viewing interests are disclosed to a remote service and the action can lead to further automated requests in connected systems.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
$OVERSEERR_URL/api/v1/search?query=<urlencoded title>

Example:
curl -s -H "X-Api-Key: $OVERSEERR_API_KEY" \
"$OVERSEERR_URL/api/v1/search?query=interstellar"

### 3) Clarify if the result is ambiguous (movie vs show with same name)

Static analysis

No suspicious patterns detected.