← Back to Skills Marketplace
tamil-9421

letterboxd-companion

by tamil-9421 · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
661
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install letterboxd-tracker
Description
Your personal movie assistant. Track what you watch, check your lists, and get movie info from Letterboxd instantly.
README (SKILL.md)

Letterboxd Skill

This skill allows the agent to retrieve information about movies or user activity from Letterboxd.

Setup

pip install letterboxdpy

Usage

Use this when the user asks about:

  • Their Letterboxd profile stats
  • Movies they've watched recently
  • Their watchlist
  • Specific movie details

Commands

lb_user

  • command: python lb_tool.py user "{{username}}"
  • description: Gets user profile stats (watched count, reviews, lists, favorites)
  • parameters:
    • username: The Letterboxd username

lb_diary

  • command: python lb_tool.py diary "{{username}}" [limit]
  • description: Gets recently watched movies from user's diary
  • parameters:
    • username: The Letterboxd username
    • limit: Optional, default 10

lb_watchlist

  • command: python lb_tool.py watchlist "{{username}}" [limit]
  • description: Gets movies in user's watchlist
  • parameters:
    • username: The Letterboxd username
    • limit: Optional, default 10

lb_movie

  • command: python lb_tool.py movie "{{slug}}"
  • description: Gets movie details (title, year, rating, directors, description)
  • parameters:
    • slug: Movie URL slug (e.g., vikram-2022, the-batman)

Examples

User: "How many movies have I watched on Letterboxd?" Agent: (Calls lb_user with username="tamilventhan")

User: "What movies did I watch recently?" Agent: (Calls lb_diary with username="tamilventhan")

User: "Show my watchlist" Agent: (Calls lb_watchlist with username="tamilventhan")

User: "Tell me about the movie Vikram" Agent: (Calls lb_movie with slug="vikram-2022")

Usage Guidance
This skill appears to do exactly what it says: scrape public Letterboxd data using the letterboxdpy library. Before installing, consider whether you trust the letterboxdpy package (review its PyPI/homepage/repo if possible) because pip installing third-party packages is a supply-chain risk. Note the skill does not request any credentials — it only accesses public profiles — so it cannot read private Letterboxd data unless you explicitly provide private session info (which the skill does not ask for). Also be aware of minor bugs (e.g., the diary code hardcodes a 2026- prefix for dates) but these are functional issues rather than security problems.
Capability Analysis
Type: OpenClaw Skill Name: letterboxd-tracker Version: 1.0.0 The skill is classified as suspicious due to a potential shell injection vulnerability identified in `SKILL.md`. The command definitions, such as `python lb_tool.py user "{{username}}"`, directly embed user-controlled parameters into a shell command string. If the OpenClaw agent does not properly sanitize or escape the `{{username}}` (or `{{slug}}`, `[limit]`) input before execution, an attacker could inject arbitrary shell commands, leading to potential Remote Code Execution (RCE). The Python script `lb_tool.py` itself appears benign and performs its stated purpose.
Capability Assessment
Purpose & Capability
Name/description promise (fetch user stats, diaries, watchlists, movie details) matches the included code and SKILL.md. The package only needs a Letterboxd-scraping client (letterboxdpy) and does not request unrelated credentials or binaries.
Instruction Scope
Runtime instructions are narrowly scoped: run lb_tool.py with a username/slug and return JSON about public Letterboxd data. The SKILL.md does not instruct reading arbitrary files, other env vars, or posting data to unexpected endpoints.
Install Mechanism
No explicit install spec for the platform, but SKILL.md and requirements.txt require pip installing letterboxdpy from PyPI. Installing third-party packages is expected for this skill, but it does introduce the usual supply-chain considerations (trustworthiness of the letterboxdpy package).
Credentials
The skill declares no required environment variables, credentials, or config paths. The code does not read environment variables or other secrets, so requested access is proportional to its purpose.
Persistence & Privilege
Skill is not marked always:true and does not modify other skills or request persistent platform privileges. It runs as an on-demand helper invoking the included Python script.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install letterboxd-tracker
  3. After installation, invoke the skill by name or use /letterboxd-tracker
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Your personal movie assistant. Track what you watch, check your lists, and get movie info from Letterboxd instantly.
Metadata
Slug letterboxd-tracker
Version 1.0.0
License
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is letterboxd-companion?

Your personal movie assistant. Track what you watch, check your lists, and get movie info from Letterboxd instantly. It is an AI Agent Skill for Claude Code / OpenClaw, with 661 downloads so far.

How do I install letterboxd-companion?

Run "/install letterboxd-tracker" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is letterboxd-companion free?

Yes, letterboxd-companion is completely free (open-source). You can download, install and use it at no cost.

Which platforms does letterboxd-companion support?

letterboxd-companion is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created letterboxd-companion?

It is built and maintained by tamil-9421 (@tamil-9421); the current version is v1.0.0.

💬 Comments