Trakt Read-only

Read-only Trakt.tv skill for checking a user’s currently watching item, recent episode history, watched shows list, stats, profile, and playback progress (OA...

This skill appears to do exactly what it says: run the included shell script to query Trakt's API. Before installing: (1) provide only TRAKT_CLIENT_ID and TRAKT_USERNAME for read-only use — only set TRAKT_ACCESS_TOKEN or TRAKT_CLIENT_SECRET if you intend to run OAuth playback/device commands; (2) keep any tokens/secrets in the agent's secure environment (do not commit them to git); (3) if you want extra caution, run the script locally once to inspect behavior (it only calls api.trakt.tv and uses curl/jq); and (4) note that the registry metadata lists only two required env vars while the docs mention optional OAuth vars — this is expected for optional features but verify you only supply secrets when needed.

Type: OpenClaw Skill Name: trakt-readonly Version: 1.0.3 The OpenClaw skill 'trakt-readonly' is designed for read-only interaction with the Trakt.tv API. The `SKILL.md` provides clear, non-malicious instructions and strong guardrails, explicitly stating to only call `https://api.trakt.tv` and never log API keys. The `scripts/trakt-api.sh` script uses `curl` and `jq` as declared, and implements input sanitization for user-provided parameters (`start_at`, `end_at`) using `jq`'s URL encoding. Environment variables like `TRAKT_USERNAME` are used as intended for API calls, and while directly interpolated into URL paths, this is generally safe with `curl` for trusted environment variables and does not indicate malicious intent or a clear shell injection vulnerability. No evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts was found.