← Back to Skills Marketplace
Stremio CLI
by
BEARLY_HODLING
· GitHub ↗
· v1.1.0
· MIT-0
221
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install stremio-cli
Description
Stremio automation via browser + Torrentio on Mac Mini. Searches for shows/movies, selects highest-seeded streams, and plays them. Use when user wants to wat...
Usage Guidance
Do not install or run this skill until the author answers these questions: (1) Why is there a hardcoded streamingServer URL (the stremio.rocks host with an IP-like subdomain) in scripts/stremio_cast.py? Who controls that host and why would your streams be proxied through it? (2) The SKILL.md says the Python script is 'legacy' and 'not used' — please remove the file or state explicitly whether the agent may execute it. (3) Explain how Stremio credentials in Keychain are used; confirm the skill will not programmatically read or transmit Keychain entries without explicit user consent. (4) Confirm whether the skill will execute local binaries (e.g., 'catt') and whether those binaries are required/trusted. If you must test, run in an isolated environment (no sensitive Keychain entries, limited network access) and audit network traffic to ensure streams aren't routed through unknown third-party servers. If these questions are answered satisfactorily (remove or sanitize the hardcoded host, explicit Keychain behavior, and a clear statement that the legacy script will not run), the incoherences would be resolved.
Capability Analysis
Type: OpenClaw Skill
Name: stremio-cli
Version: 1.1.0
The skill contains a potential shell injection vulnerability in `scripts/stremio_cast.py` where the `device` argument (sourced from command-line input) is passed unsanitized to `subprocess.Popen`. Additionally, the bundle includes hardcoded personal information (email address) and specific local network IP addresses in `SKILL.md` and the Python script, which indicates a lack of sanitization for a shared component.
Capability Assessment
Purpose & Capability
The skill claims to rely on the built-in browser tool and needs no credentials, but the bundle includes a Python script that embeds a hardcoded streamingServer URL (a stremio.rocks host with an IP-like subdomain) and assumes 'catt' is installed. That script's behavior (intercepting stream URLs and casting them) is related to the stated purpose, but the presence of a hardcoded third-party streaming server and a legacy script that the SKILL.md says is 'not used' is an incoherence that needs justification.
Instruction Scope
SKILL.md instructs the agent to use the browser tool only and does not direct the agent to read system secrets; however it explicitly states 'Credentials for Stremio account are in Keychain' (with a specific email), which implies use of system credential storage. The included script would capture stream URLs from web requests and hand them to a local casting tool — behavior not described in the SKILL.md. The mismatch between the instructions and the included script expands the effective scope and is potentially risky.
Install Mechanism
There is no install spec (instruction-only), which is low risk, but a code file is present. Since no install runs automatically, nothing will be written during install; however the included script assumes Playwright and 'catt' exist in the runtime environment. The absence of an install spec plus included runnable code is an odd combination that should be clarified.
Credentials
The skill declares no required environment variables, but SKILL.md calls out Stremio credentials stored in macOS Keychain (and even includes a specific email). Requiring access to system Keychain data is sensitive. The package does not declare or explain how credentials are retrieved; the included script doesn't access Keychain but would operate under the environment's existing session. This gap between claimed credential location and declared requirements is disproportionate and unclear.
Persistence & Privilege
The skill does not request always:true and does not declare changes to other skills or persistent system-wide configuration. Autonomous invocation is allowed by default, which is normal. There is no install-time persistence requested by the manifest.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install stremio-cli - After installation, invoke the skill by name or use
/stremio-cli - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
Clean English version using built-in browser tool + Torrentio. Removed Portuguese casting code and Chromecast dependency. Matches existing memory for Stremio automation on Mac Mini.
v1.0.1
Security fix: removed hardcoded Keychain email. Now uses STREMIO_ACCOUNT env var or defaults safely.
v1.0.0
Initial release - natural language Stremio automation with Torrentio + Playwright
Metadata
Frequently Asked Questions
What is Stremio CLI?
Stremio automation via browser + Torrentio on Mac Mini. Searches for shows/movies, selects highest-seeded streams, and plays them. Use when user wants to wat... It is an AI Agent Skill for Claude Code / OpenClaw, with 221 downloads so far.
How do I install Stremio CLI?
Run "/install stremio-cli" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Stremio CLI free?
Yes, Stremio CLI is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Stremio CLI support?
Stremio CLI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Stremio CLI?
It is built and maintained by BEARLY_HODLING (@bearly-hodling); the current version is v1.1.0.
More Skills