← Back to Skills Marketplace
791
Downloads
2
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install torrentclaw
Description
Search and download torrents via TorrentClaw. Use when the user asks to find, search, or download movies, TV shows, or torrents. Detects local torrent client...
Usage Guidance
This skill appears to do what it says: search an external TorrentClaw API and add magnet links to local torrent clients. Two things to consider before installing: (1) metadata vs documentation mismatch — the registry marks TORRENTCLAW_API_KEY as required but SKILL.md says the key is optional; ask the publisher which is true and only supply your API key if you trust the service. (2) The skill sends requests to https://torrentclaw.com and adds an x-search-source header for analytics, and its add-torrent script will interact with local daemons (transmission/aria2) and may start background aria2 processes — only install if you trust those network interactions and understand legal/privacy implications of torrenting. If you want lower risk, install but do not set TORRENTCLAW_API_KEY (use anonymous mode) and review/limit the skill's access to local clients or run it in an isolated environment. If you need higher assurance, ask the publisher for a signed release or a canonical repository URL and clarification about the API-key requirement.
Capability Analysis
Type: OpenClaw Skill
Name: torrentclaw
Version: 0.1.17
The skill is designed to search and download torrents, a functionality that inherently requires shell and network access. While the `CHANGELOG.md` indicates that previous versions contained shell injection vulnerabilities in `SKILL.md`'s curl commands and `add-torrent.sh`'s aria2 RPC JSON construction, these issues have been explicitly fixed. The current `SKILL.md` correctly uses `curl --data-urlencode` for user input, and `add-torrent.sh` employs `jq --arg` for safe JSON construction and robust magnet URL validation, demonstrating adherence to secure coding practices. No evidence of intentional malicious behavior, such as data exfiltration or unauthorized remote control, was found.
Capability Assessment
Purpose & Capability
Name/description, declared binaries (curl, bash, jq), and included scripts (detect-client, add-torrent, install-guide) are consistent with a torrent search/download skill. The only mismatch: registry metadata marks TORRENTCLAW_API_KEY as a required env var / primary credential, while SKILL.md explicitly states the API key is optional (anonymous use allowed). That inconsistency is unexplained.
Instruction Scope
SKILL.md stays within the stated purpose: it instructs the agent to detect local torrent clients, call the TorrentClaw API, present results, and add magnets or provide torrent files. It does reference local system state (detects installed clients, may call transmission-remote or localhost aria2 RPC) which is expected for the feature. It also instructs adding an 'x-search-source: skill' header (telemetry/analytics) — notable but consistent with the described API.
Install Mechanism
No external install step is provided (instruction-only skill). All included scripts are plain shell, readable, and not obfuscated. No downloads from untrusted URLs or archive extraction are present in the skill bundle itself.
Credentials
The only credential requested is TORRENTCLAW_API_KEY, which is appropriate for an API-backed search service — but the metadata marks it required while the runtime docs say the key is optional (anonymous rate-limited access). This contradictory requirement is concerning: the skill should not force users to provide a secret if anonymous mode is supported. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request permanent or global presence (always:false). It runs local scripts when invoked and may start background aria2 processes, but it does not modify other skills or system-wide agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install torrentclaw - After installation, invoke the skill by name or use
/torrentclaw - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.17
Fix shell injection vulnerability in SKILL.md curl search commands. Replace direct URL interpolation with curl -G --data-urlencode for all user-supplied query parameters.
v0.1.16
Security: fix shell injection vulnerability, add input validation, safe JSON construction with jq
v0.1.14
Fix: detect transmission-gtk and qt variants in client detection
Metadata
Frequently Asked Questions
What is TorrentClaw?
Search and download torrents via TorrentClaw. Use when the user asks to find, search, or download movies, TV shows, or torrents. Detects local torrent client... It is an AI Agent Skill for Claude Code / OpenClaw, with 791 downloads so far.
How do I install TorrentClaw?
Run "/install torrentclaw" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TorrentClaw free?
Yes, TorrentClaw is completely free (open-source). You can download, install and use it at no cost.
Which platforms does TorrentClaw support?
TorrentClaw is cross-platform and runs anywhere OpenClaw / Claude Code is available (darwin, linux, win32).
Who created TorrentClaw?
It is built and maintained by buryni (@buryni); the current version is v0.1.17.
More Skills