Trakt

Track and view your watched movies and TV shows via trakt.tv. Use when user asks about their watch history, what they've been watching, or wants to search for movies/shows.

This skill appears to do what it says: it relies on the third‑party 'trakt-cli' npm package and your own trakt OAuth app to read your watch history. Before installing: (1) verify the trakt-cli npm package and its maintainer (inspect package page and source) since the SKILL.md suggests a global npm install; (2) avoid installing global npm packages as root/sudo if possible; (3) be aware authentication tokens will be stored in ~/.trakt.yaml — check its filesystem permissions and contents; (4) note the registry metadata did not list the required binary even though SKILL.md requires it — double-check that your environment has trakt-cli or that you are comfortable installing it. If you do not trust the npm package or the skill source, do not install.

Type: OpenClaw Skill Name: trakt Version: 0.1.0 The skill is designed to interact with trakt.tv for watch history and search, which aligns with its stated purpose. However, the `SKILL.md` file includes an instruction to install `trakt-cli` globally via `npm install -g trakt-cli`. While this is a standard method for installing CLI tools and is necessary for the skill's functionality, it represents a high-privilege operation that could lead to arbitrary code execution if the `trakt-cli` npm package were compromised, posing a supply chain risk. This constitutes a risky capability without clear malicious intent from the skill author, classifying it as suspicious.