Radarr+

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:09 AM UTC
• Version: 0.1.7

Overview

Radarr+ is a coherent media-management skill whose Radarr, metadata, notification, and optional Plex behaviors are disclosed, with some scoping issues users should understand.

Install only if you intend to give the skill access to your Radarr API key and, optionally, TMDB/OMDb/Plex credentials. Review the outbox/cron sender configuration so progress messages go only to intended chats, and consider constraining or hardening fetch_asset.py before use in high-trust environments because it can download from arbitrary URLs to arbitrary writable paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly requires sensitive capabilities including environment access, shell execution, file read/write, and network access, but those permissions are not explicitly declared. This weakens reviewability and containment because operators may enable the skill without understanding its full execution and data-access surface, including API secrets and local state files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes well beyond Radarr movie management: it fetches third-party metadata, downloads remote assets to disk, polls and persists tracking state, queues outbound notifications, and queries Plex. This mismatch is dangerous because reviewers and users may grant trust based on the narrow Radarr description while the skill actually expands data exposure, persistence, and network interaction across multiple services.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The workflow includes persistent local queueing, outbox generation, and chat-targeted status notifications, none of which are reflected in the manifest's narrower Radarr management description. This is security-relevant because it introduces retained state, message routing, and automated outbound communication that can expose user metadata or create unintended notification behaviors if misconfigured or abused.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script accepts an arbitrary URL and arbitrary output path, then fetches the remote content and writes it directly to disk with no allowlist, scheme restriction, size checks, or path confinement. In an agent/skill context, this broad primitive can be repurposed beyond the stated Radarr use case for SSRF-style access to internal resources or for overwriting files the agent has permission to modify, making it a genuine capability-expansion vulnerability even if intended for poster downloads.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script expands the skill from Radarr management into Plex server discovery and link generation, which is outside the declared skill scope. Scope drift is dangerous because it introduces access to an additional service and data domain that users and reviewers would not reasonably expect, increasing the chance of unauthorized data access or credential misuse.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This code reads PLEX_URL and PLEX_TOKEN from the environment and performs authenticated requests to a separate Plex server, despite the skill being presented as Radarr-only. That creates a hidden cross-service capability: an agent authorized for Radarr workflows can silently use Plex credentials to enumerate or query another media system, violating least privilege and user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file implements persistent tracking, notification queuing, and optional Plex-link generation beyond the declared Radarr API management scope. Capability drift matters because operators may grant or trust this skill for Radarr actions without realizing it also produces outbound message artifacts and touches other integrations, expanding the attack surface and data-flow footprint.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This code writes outbound notification jobs containing channel, target, and text for external delivery, including Telegram-style targets, which exceeds a Radarr-only media-management purpose. Even though it only queues messages rather than sending them directly, it creates a covert data egress path through the broader system and may leak user activity, titles, or identifiers to external channels.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script conditionally invokes a Plex helper based on Plex environment variables, adding cross-service integration not covered by the stated Radarr API scope. This broadens privilege and data access: a skill trusted for Radarr can now interact with Plex-linked metadata and generate links, increasing blast radius if abused or misconfigured.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.