Qbittorrent

Manage torrents with qBittorrent. Use when the user asks to "list torrents", "add torrent", "pause torrent", "resume torrent", "delete torrent", "check download status", "torrent speed", "qBittorrent stats", or mentions qBittorrent/qbit torrent management.

This skill appears coherent for managing qBittorrent, but check a few things before installing: (1) Inspect the included scripts yourself — qbit-api.sh uses curl and jq (ensure they exist and are acceptable on your system). (2) The skill requires qBittorrent WebUI credentials stored in a plaintext JSON config (~/.clawdbot/credentials/qbittorrent/config.json) or environment variables; consider file permissions and use a least-privileged account. (3) Ensure QBIT_URL points to a trusted host (prefer localhost) — do not expose credentials to a remote, untrusted WebUI. (4) The registry metadata omits declaring required binaries/envs; if you rely on automatic environment checks, add curl/jq to your environment first. If any of these points are unacceptable (e.g., you cannot store credentials locally or cannot trust the WebUI endpoint), do not enable the skill.

Type: OpenClaw Skill Name: qbittorrent Version: 1.0.0 The skill is designed to manage qBittorrent via its WebUI API. The `SKILL.md` provides clear instructions for the AI agent without any prompt injection attempts. The `scripts/qbit-api.sh` script correctly reads qBittorrent credentials from a designated configuration file (`~/.clawdbot/credentials/qbittorrent/config.json`) or environment variables and uses `curl` to interact with the user-configured qBittorrent instance. All network calls are directed to the specified qBittorrent URL, and file operations are limited to its own configuration, session cookie management in `/tmp`, and reading `.torrent` files for the 'add-file' functionality. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The script's actions are entirely aligned with its stated purpose.