MovieFetch

Download, track, and remove movies across Plex, Radarr, and qBittorrent from chat. Triggers on user requests like "get <movie>", "status of <movie>", or "rem...

This skill's code matches its stated purpose, but it requires multiple sensitive credentials that the registry metadata does not declare. Before installing or enabling it: 1) Don't provide high-privilege or shared credentials — create least-privilege accounts/API keys for Radarr/Plex/qBittorrent if possible. 2) Verify and set the following env vars (examples in README): RADARR_URL, RADARR_API_KEY, RADARR_QUALITY_PROFILE_ID, RADARR_ROOT_FOLDER, PLEX_URL, PLEX_TOKEN, PLEX_MOVIE_LIBRARY, QBIT_URL, QBIT_USERNAME, QBIT_PASSWORD, and optionally TMDB_API_KEY. 3) Be aware remove_movie defaults to deleting files (delete_files default true) — confirm behavior and perhaps change default to avoid accidental data loss. 4) Because the skill can be invoked autonomously, avoid enabling it in agents that have access to broader secrets or production systems. 5) If you need more confidence, run the unit tests in an isolated sandbox with mock services, or request that the publisher update the registry metadata to explicitly declare required env vars and the primary credential so you can audit them before granting access.

Type: OpenClaw Skill Name: moviefetch Version: 0.1.0 The moviefetch skill is a legitimate integration for managing a home media stack (Plex, Radarr, and qBittorrent). The scripts (e.g., check_plex.py, request_movie.py, and check_download.py) perform standard API operations using environment-configured credentials to search, add, track, and remove media. No evidence of data exfiltration, malicious code execution, or prompt injection was found; the logic strictly follows the stated purpose of conversational media management.