nzbget

Check NZBGet download status and queue information. Use when the user asks about NZBGet downloads, wants to know how many things are downloading, check download speed, view the queue, or get a full status report of their Usenet downloads.

This skill looks like it really queries NZBGet, but there are some mismatches and security details you should address before installing: (1) The registry metadata does not declare the required environment variables (NZBGET_USER, NZBGET_PASS, NZBGET_HOST) nor required binaries (curl, jq, bc) — require the publisher to correct the manifest. (2) The script embeds credentials in the URL and uses http://, which can expose your NZBGet credentials to network eavesdroppers and potentially other local users (process lists). Prefer HTTPS and use curl --user or a header-based auth to avoid credentials in the URL. (3) Ensure the agent runs the script in a trusted, isolated environment and that the NZBGet host is reachable over TLS. If you need help hardening it, ask the publisher to update the script to use HTTPS by default (or a configurable scheme), avoid putting creds in the URL, and document the prerequisites.

Type: OpenClaw Skill Name: nzbget Version: 1.0.1 The skill bundle is designed to check NZBGet download status and queue information. It uses environment variables (NZBGET_USER, NZBGET_PASS, NZBGET_HOST) to authenticate and connect to a user-defined NZBGet instance via its JSON-RPC API using `curl`. The `SKILL.md` provides clear instructions for the agent without any prompt injection attempts. The `scripts/check_nzbget.sh` script uses standard tools (`curl`, `jq`, `bc`) to retrieve and parse status information, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or other harmful behaviors beyond its stated purpose.