Radarr+

Add and manage movies in a Radarr instance via its HTTP API (search/lookup movies, list quality profiles and root folders, add a movie by title/year or TMDB id, and trigger a search). Use when the user asks to add/request/download a movie via Radarr/Plex, or when automating Radarr-based media workflows.

Security Scan

The skill's code and runtime instructions mostly match a Radarr integration, but registry metadata omits required secrets and a few scripts contain hardcoded paths and a shell-based exec call that make the package fragile and potentially risky for some deployments.

Purpose & Capability

The skill's name/description align with the code: scripts talk to Radarr and optionally TMDB/OMDb/Plex and provide add/lookup/track flows. However, the registry metadata declares no required environment variables or primary credential while the scripts require RADARR_URL and RADARR_API_KEY (plus optional TMDB/OMDB/PLEX creds). That metadata mismatch is an incoherence the user should be aware of.

Instruction Scope

SKILL.md and the scripts instruct the agent to read environment variables, call local CLI scripts, talk to Radarr/TMDB/OMDb/Plex, download poster images, and write state files under workspace/state/radarr. Those actions are expected for a Radarr integrator. Concerns: some scripts call absolute paths (/home/vishix/.openclaw/workspace) and resolve_defaults uses a shell -lc invocation that concatenates args into a command string — this introduces fragility and a modest injection surface if untrusted inputs are ever passed through that path.

Install Mechanism

No external install/download steps are declared (instruction-only + bundled scripts). There are no remote download URLs or extract steps in the manifest, so nothing arbitrary is pulled from the network at install time. The risk here is limited to the code shipped in the skill itself.

Credentials

The runtime requires RADARR_URL and RADARR_API_KEY (and optionally TMDB_API_KEY, OMDB_API_KEY, PLEX_URL, PLEX_TOKEN). Those envs are proportionate to the described functionality. The problem is the registry metadata incorrectly lists no required envs/primary credential, which is misleading. Scripts also use OPENCLAW_WORKSPACE and assume secrets are loaded from ~/.openclaw/.env; these envs/paths are not declared in the registry metadata.

Persistence & Privilege

The skill is not always-enabled and does not request elevated system privileges. It writes state under workspace/state/radarr and uses its own scripts; it does not modify other skills' configs. Autonomous invocation is enabled (platform default) but not combined with other high-privilege requests.

What to consider before installing

This package appears to implement a legitimate Radarr integration, but there are a few red flags to address before installing: - Metadata vs runtime mismatch: The registry entry claims no required environment variables, yet the scripts require RADARR_URL and RADARR_API_KEY (plus optional TMDB/OMDB/PLEX creds). Treat the latter as required and do not rely on the registry metadata. Ensure you only provide the Radarr API key to skills you trust. - Secrets handling: The SKILL.md tells you to place secrets in ~/.openclaw/.env. Confirm your OpenClaw setup actually sources that file into the environment for the runtime. Store secrets securely and avoid committing .env files. - Hardcoded paths: Several scripts call absolute paths such as /home/vishix/.openclaw/workspace or run bash -lc with a concatenated command. Update those paths to your actual OpenClaw workspace before enabling the skill, or run the skill in a controlled test environment first. - Shell invocation risk: resolve_defaults uses bash -lc and builds a command by joining args into a string. Although current calls appear safe, avoid passing untrusted user input through that code path; consider patching it to use a direct exec (no shell) if you will feed user-supplied values into it. - Test before trusting: Run ./skills/radarr/scripts/check_env.py and the ping/profile/root commands against a non-production Radarr instance, inspect the state directory (workspace/state/radarr) to see what the skill writes, and confirm outbound network calls are only to your Radarr instance and the optional add-ins (TMDB, OMDb, Plex) you expect. If you can get the skill's source repository or contact the author, ask them to (1) correct the registry metadata to list required env vars, (2) remove hardcoded /home/vishix paths or make them configurable, and (3) avoid constructing shell commands with unescaped user data. Those changes would raise confidence that the skill is safe to deploy.

Request movies from chat and have them added to Radarr (with progress updates back in the same chat).

What it looks like (example)

Here’s an example of the single-message poster card + caption users will receive when requesting a movie (poster attachment + trailer + rating):

Example message caption:

Shutter Island (2010)

⭐ IMDb: 8.2/10

🎬 Trailer: https://www.youtube.com/watch?v=qdPw9x9h5CY

Added to Radarr ✅ (Ultra-HD, /movies). I’ll post progress + “imported ✅” here.

Setup (one-time)

1. Set secrets in ~/.openclaw/.env (never commit these):

• RADARR_URL=http://<host>:7878
• RADARR_API_KEY=...

Optional (recommended for fewer questions later):

• RADARR_DEFAULT_PROFILE=HD-1080p
• RADARR_DEFAULT_ROOT=/data/media/movies

Optional (for the “rich” experience we’ll add next):

• TMDB_API_KEY=... (poster + trailer)
• OMDB_API_KEY=... (IMDb rating)
• PLEX_URL=http://<plex-host>:32400
• PLEX_TOKEN=...

2. Verify env + connectivity:

./skills/radarr/scripts/check_env.py
./skills/radarr/scripts/radarr.sh ping

If it fails, check:

• Radarr is reachable from the OpenClaw host
• API key is correct
• URL is correct (http vs https)

Common tasks

List available quality profiles

./skills/radarr/scripts/radarr.sh profiles

List configured root folders

./skills/radarr/scripts/radarr.sh roots

Lookup/search a movie

./skills/radarr/scripts/radarr.sh lookup --compact "inception"
./skills/radarr/scripts/radarr.sh lookup --compact "tmdb:603"

Add a movie (preferred: TMDB id)

./skills/radarr/scripts/radarr.sh add --tmdb 603 --profile "HD-1080p" --root "/data/media/movies" --monitor --search

Add a movie (by title; optionally prefer a year)

./skills/radarr/scripts/radarr.sh add --term "Dune" --year 2021 --profile "HD-1080p" --root "/data/media/movies" --monitor --search

Chat workflow (recommended)

When the user says “request/add <movie>” (DM or group):

1) Lookup

Run:

• ./skills/radarr/scripts/radarr.sh lookup --compact "<movie>"

If there are multiple plausible matches, ask the user to choose (year or TMDB id).

2) Resolve missing config by prompting

Resolve defaults from env (and fetch prompt options when missing):

./skills/radarr/scripts/resolve_defaults.py

If defaults are missing, prompt the user to pick one of the returned options:

• options.profiles[]
• options.roots[]

(If defaults exist, use them silently.)

3) Optional rich “movie card” (add-ins)

If TMDB_API_KEY is set, build a movie card:

./skills/radarr/scripts/movie_card.py --tmdb <id>

• If the output includes posterUrl, you can download it and attach it:

./skills/radarr/scripts/fetch_asset.py --url "<posterUrl>" --out "./outbound/radarr/<tmdbId>.jpg"

If OMDB_API_KEY is set and an IMDb id is known, the card will include IMDb rating.

4) Add to Radarr

Use TMDB when possible:

./skills/radarr/scripts/radarr.sh add --tmdb <id> --profile "<profile>" --root "<root>" --monitor --search

5) Track progress + notify in the same chat (Radarr-only, polling)

This skill provides a file-based tracker queue:

1. Enqueue tracking for the same chat where the request came from (DM or group):

./skills/radarr/scripts/enqueue_track.py --channel telegram --target "<chatId>" --movie-id <id> --title "<title>" --year <year>

2. A periodic dispatcher should run:

./skills/radarr/scripts/poll_and_queue.py

This will create outbox items under ./state/radarr/outbox/ that your OpenClaw cron runner can send.

6) Plex link (optional add-in)

If Plex is configured, try to produce a Plex web URL:

./skills/radarr/scripts/plex_link.py --title "<title>" --year <year>

References

• Onboarding: references/onboarding.md
• Setup: references/setup.md
• API notes: references/radarr-api-notes.md