← 返回 Skills 市场
titunito

Jellyfin Control

作者 Titunito · GitHub ↗ · v1.3.0
cross-platform ⚠ suspicious
963
总下载
2
收藏
1
当前安装
5
版本数
在 OpenClaw 中安装
/install jellyfin-control
功能描述
Control Jellyfin media server and TV. Search content, resume playback, manage sessions, control TV power and apps. Supports Home Assistant and direct WebOS b...
使用说明 (SKILL.md)

Jellyfin Control

A robust skill to control Jellyfin playback and TV power via CLI.

Features

  • 🎯 One-Command Play: tv play "Breaking Bad" — turns on TV, launches Jellyfin, finds the next episode, and plays it.
  • Smart Resume: Automatically finds the next unplayed episode for series.
  • Resume Position: Resumes Movies/Episodes exactly where left off (with Seek fallback for LG WebOS/Tizen).
  • Device Discovery: Auto-detects controllable sessions (TVs, Phones, Web).
  • Remote Control: Full playback control (play, pause, stop, next, prev, volume, mute).
  • TV Power & Apps: Turn TV on/off, launch apps — works with or without Home Assistant.
  • Two TV Backends: Home Assistant integration or direct WebOS (LG TVs, no HA needed).
  • Android TV Support: Direct ADB backend for Chromecast w/ Google TV, Nvidia Shield, Fire TV, Mi Box — no HA needed.
  • Three connection modes: Home Assistant (any TV), direct WebOS (LG), direct ADB (Android TV/Fire TV).

Quick Start

Minimal setup (Jellyfin only, no TV control)

{
  "skills": {
    "entries": {
      "jellyfin-control": {
        "env": {
          "JF_URL": "http://YOUR_IP:8096",
          "JF_API_KEY": "your-api-key-here",
          "JF_USER": "your-username"
        }
      }
    }
  }
}

With Home Assistant (recommended for TV control)

{
  "skills": {
    "entries": {
      "jellyfin-control": {
        "env": {
          "JF_URL": "http://192.168.1.50:8096",
          "JF_API_KEY": "your-jellyfin-api-key",
          "JF_USER": "victor",
          "HA_URL": "http://192.168.1.138:8123",
          "HA_TOKEN": "your-ha-long-lived-token",
          "HA_TV_ENTITY": "media_player.lg_webos_tv_oled48c34la",
          "TV_MAC": "AA:BB:CC:DD:EE:FF"
        }
      }
    }
  }
}

Direct WebOS (LG TV, no Home Assistant needed)

{
  "skills": {
    "entries": {
      "jellyfin-control": {
        "env": {
          "JF_URL": "http://192.168.1.50:8096",
          "JF_API_KEY": "your-jellyfin-api-key",
          "JF_USER": "victor",
          "TV_IP": "192.168.1.100",
          "TV_MAC": "AA:BB:CC:DD:EE:FF"
        }
      }
    }
  }
}

First time with WebOS direct: The TV will show a pairing prompt. Accept it and save the TV_CLIENT_KEY the skill prints — add it to your env to skip the prompt next time.

Direct ADB (Android TV / Fire TV / Chromecast with Google TV, no HA needed)

{
  "skills": {
    "entries": {
      "jellyfin-control": {
        "env": {
          "JF_URL": "http://192.168.1.50:8096",
          "JF_API_KEY": "your-jellyfin-api-key",
          "JF_USER": "victor",
          "ADB_DEVICE": "192.168.1.100:5555",
          "TV_MAC": "AA:BB:CC:DD:EE:FF"
        }
      }
    }
  }
}

First time with ADB: Enable Developer Options on your TV (Settings → About → tap Build Number 7 times), then enable Network/USB debugging. First connection will show "Allow debugging?" on the TV — accept it. Requires adb installed on the OpenClaw host (sudo apt install adb).

Environment Variables

Jellyfin (required)

Variable Required Description
JF_URL Yes Base URL of your Jellyfin server, e.g. http://192.168.1.50:8096
JF_API_KEY Yes API key from Jellyfin Dashboard → Advanced → API Keys
JF_USER No Username — used to resolve user ID for user-specific endpoints
JF_USER_ID No User ID directly — avoids needing to call /Users
JF_PASS No Password — only if authenticating by user session

TV Control (optional — choose one backend)

Variable Backend Description
TV_BACKEND All Force backend: homeassistant, webos, androidtv, or auto
TV_PLATFORM HA Force platform: webos or androidtv (auto-detected from entity)
HA_URL HA Home Assistant URL, e.g. http://192.168.1.138:8123
HA_TOKEN HA HA long-lived access token (Profile → Long-Lived Access Tokens)
HA_TV_ENTITY HA Entity ID of your TV, e.g. media_player.lg_webos_tv_oled48c34la
TV_IP WebOS LG TV IP address for direct WebOS SSAP connection
TV_CLIENT_KEY WebOS Pairing key (printed on first connection — save it!)
ADB_DEVICE AndroidTV TV address for ADB, e.g. 192.168.1.100:5555
TV_MAC All TV MAC address for Wake-on-LAN (needed to turn on TV)
TV_JELLYFIN_APP All Override Jellyfin app ID (auto: org.jellyfin.webos / org.jellyfin.androidtv)
TV_BOOT_DELAY All Seconds to wait after TV wake (default: 10)
TV_APP_DELAY All Seconds to wait after launching Jellyfin (default: 8)

Auto-detection: If TV_BACKEND is auto (default):

  1. HA_URL + HA_TOKEN + HA_TV_ENTITY set → Home Assistant backend
  2. ADB_DEVICE set → direct ADB (Android TV)
  3. TV_IP set → direct WebOS (LG)
  4. Nothing set → TV commands disabled, Jellyfin-only mode

Usage

🎯 One-Command Play (the magic)

Turn on TV → launch Jellyfin → find next episode → play it. All in one command:

node skills/jellyfin-control/cli.js tv play "Breaking Bad"
node skills/jellyfin-control/cli.js tv play "The Matrix"

The skill validates the content exists BEFORE turning on the TV (fail fast).

Resume / Play Smart

If TV and Jellyfin are already running:

node skills/jellyfin-control/cli.js resume "Breaking Bad"
node skills/jellyfin-control/cli.js resume "Matrix" --device "Chromecast"

TV Control

node skills/jellyfin-control/cli.js tv on           # Turn on (Wake-on-LAN)
node skills/jellyfin-control/cli.js tv off          # Turn off
node skills/jellyfin-control/cli.js tv launch       # Launch Jellyfin app
node skills/jellyfin-control/cli.js tv launch com.webos.app.hdmi1  # Launch specific app
node skills/jellyfin-control/cli.js tv apps         # List installed apps

Remote Control

node skills/jellyfin-control/cli.js control pause
node skills/jellyfin-control/cli.js control play
node skills/jellyfin-control/cli.js control next
node skills/jellyfin-control/cli.js control vol 50

Search Content

node skills/jellyfin-control/cli.js search "Star Wars"

Library Stats & Scan

node skills/jellyfin-control/cli.js stats
node skills/jellyfin-control/cli.js scan            # requires admin API key

User History (requires admin API key)

node skills/jellyfin-control/cli.js history
node skills/jellyfin-control/cli.js history jorge --days 7

Choosing a TV Backend

Feature Home Assistant Direct WebOS Direct ADB (Android TV) No Backend
TV brands Any (via HA) LG only Android TV, Fire TV, CCwGTV
Turn on (WoL) ✅ (WoL or ADB wakeup)
Turn off
Launch apps
List apps ✅ (via HA logs) ✅ (direct output) ✅ (direct output)
Extra dependency None npm install ws apt install adb None
Setup complexity Medium (need HA) Low (TV IP + MAC) Low (enable ADB on TV) None
Jellyfin playback

Recommendation:

  • Already have Home Assistant? → Use HA backend (most versatile, any TV brand)
  • LG WebOS TV, no HA? → Use direct WebOS backend
  • Android TV / Fire TV / Chromecast with Google TV, no HA? → Use direct ADB backend
  • No smart TV control needed? → Skip TV config, resume works if Jellyfin app is already open

Security Notes

  • API keys only in openclaw.json env — never in workspace files, .env files, or markdown docs.
  • HA tokens are long-lived and powerful. Create a dedicated HA user with limited permissions if possible.
  • TV_CLIENT_KEY (WebOS) is sensitive — it allows full control of your TV. Treat it like a password.
  • ADB access grants full control of your Android TV. Ensure your network is secured — anyone on the same network could connect via ADB if debugging is enabled.
  • Admin operations (history, scan) require an admin-level Jellyfin API key and will fail gracefully with 403 if permissions are insufficient.

Architecture

  • lib/jellyfin.js — Jellyfin REST API (auth, search, sessions, playback control)
  • lib/tv.js — TV control abstraction (HA backend, WebOS backend, Wake-on-LAN)
  • cli.js — User-friendly CLI with all commands

Workflow: Agent says "Play Star Trek on TV"

Agent → cli.js tv play "Star Trek"
         │
         ├── 1. Search Jellyfin for "Star Trek" (fail fast)
         ├── 2. Find next unplayed episode
         ├── 3. Wake-on-LAN → TV turns on
         ├── 4. Wait 10s for boot
         ├── 5. Launch Jellyfin app (HA or WebOS)
         ├── 6. Wait 8s for session registration
         ├── 7. Find Jellyfin session (retry 3x)
         └── 8. Play episode on session
安全使用建议
This skill appears to do what it says (control Jellyfin and TVs) and asks for the expected credentials. However, it runs system commands (adb) via child_process.execSync and builds command strings from environment variables and CLI arguments (app IDs, ADB device strings). If you plan to use the direct ADB backend, be aware that malformed or malicious input could result in shell injection on the host. Recommendations before installing: - Prefer the Home Assistant backend (HA_URL + HA_TOKEN) if you want to avoid the skill running local adb commands. - If you must use direct ADB, ensure adb is installed in a restricted environment and avoid placing untrusted values into TV_JELLYFIN_APP or ADB_DEVICE; treat those env vars as trusted configuration only. - Do not give the skill an admin-level Jellyfin API key unless you need admin features (history/scan); prefer a dedicated low-permission key. - Save TV pairing keys (TV_CLIENT_KEY) securely — they grant full TV control. - The package includes package.json and the README instructs running npm install locally; the registry entry lacks an explicit install spec, so follow the README (run npm install in the skill directory) and audit dependencies prior to installation. Given the clear command-execution vectors in tv.js, review the code and run the skill in a constrained environment (or prefer HA backend) if you are not comfortable with local shell commands being executed.
功能分析
Type: OpenClaw Skill Name: jellyfin-control Version: 1.3.0 The skill is classified as suspicious due to a critical shell injection vulnerability (RCE) in `tv.js`. When the `androidtv` backend is used, the `launchApp` function directly embeds the user-controlled `appId` into a command executed via `child_process.execSync` without proper sanitization. This allows an attacker to inject arbitrary shell commands on the OpenClaw host machine by manipulating the `appId` argument (e.g., via `cli.js tv launch "com.app; rm -rf /"`). While this is a severe vulnerability, there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, backdoor installation) by the skill itself, aligning with the 'suspicious' classification for exploitable flaws rather than 'malicious' for intentional malware.
能力评估
Purpose & Capability
The declared env vars (JF_URL, JF_API_KEY, optional HA_*, TV_*, ADB_DEVICE) and the code (jellyfin.js + tv.js) align with the described features (search, resume, play, Home Assistant, WebOS, ADB). Required variables are relevant to the stated functionality.
Instruction Scope
SKILL.md instructions stay within the skill's domain: they instruct the agent to talk to Jellyfin, Home Assistant, TVs, or the adb binary and to store credentials in openclaw.json. They do not ask the agent to read unrelated system files. However, the runtime code issues system commands (adb via child_process.execSync) and constructs shell command strings from env/CLI inputs (app IDs, device strings), which grants the skill broad ability to execute local shell commands when using the ADB backend.
Install Mechanism
Registry lists no install spec, but the package contains package.json and README instructs running npm install and optional installation of adb/ws. There is no remote URL or extractor risk; dependencies are standard (axios, fuse.js, yargs). The missing platform-level install spec is an inconsistency (code exists but no formal install step declared).
Credentials
Requested env vars (Jellyfin, Home Assistant, TV settings, ADB) are appropriate for the described backends. Notes: JF_PASS or an admin API key can grant elevated access (listing users, activity log), and HA_TOKEN or TV_CLIENT_KEY give control over Home Assistant and/or the TV — treat these tokens as sensitive. The skill will fail or exit if JF_API_KEY is not present, which matches the functionality.
Persistence & Privilege
always:false and normal model-invocation defaults are used. The skill does not request persistent platform-wide privileges or modify other skills. No 'always' or similar high-privilege flags are present.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install jellyfin-control
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /jellyfin-control 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.3.0
Android TV/Fire TV direct control & backend auto-detection added. - Adds direct ADB backend for Android TV, Chromecast with Google TV, Nvidia Shield, Fire TV, and Mi Box (no Home Assistant required). - Updates environment variables: new options `ADB_DEVICE` and `TV_PLATFORM`; more descriptive backend auto-detection. - Documentation expanded to cover Android TV setup and connection instructions. - `metadata.tags` updated with "androidtv"; clarifies backend/platform options for TV control. - No code or file changes detected—documentation-only release.
v1.2.0
Major update: Adds direct TV control (power, apps, and playback) with Home Assistant and WebOS support. - Introduced full TV control: turn on/off, launch apps, and play Jellyfin content directly from CLI. - Added support for two TV backends: Home Assistant integration (for any brand) and direct LG WebOS connection (no HA required). - New "one-command play" feature turns on TV, launches Jellyfin, and starts playback in a single step. - Expanded environment variables for TV integration, including auto-detection of backend. - Removed legacy API logic file (`lib/jellyfin.js`); added new modular files for Jellyfin and TV control. - Updated documentation with setup instructions for all supported TV configurations.
v1.1.1
**Major update: Adds TV power/app control and multi-backend support (Home Assistant & direct WebOS) to Jellyfin CLI skill.** - Introduced new CLI commands for TV power, app launching, and one-command play ("tv play" turns on TV, opens Jellyfin, plays content). - Supports two TV control backends: Home Assistant integration (any TV via HA) or direct LG WebOS control (LG TVs, no HA needed). - Expanded environment variable options for TV integration, including HA and WebOS connection details. - Core logic separated into new files: added `jellyfin.js` and `tv.js`. - Removed old `lib/jellyfin.js` and `package-lock.json` for a leaner structure. - Updated skill documentation with setup guides, environment variables, backend comparison, and quick-start instructions.
v1.1.0
jellyfin-control 1.1.0 adds new commands and enhances configuration and security. - Added library stats and scan commands for quick overviews and on-demand refresh (admin-only for scan). - Introduced detailed environment variable documentation, including optional JF_USER, JF_USER_ID, and JF_PASS. - Improved security section with best practices for API key usage and credential handling. - Expanded remote control options: full playback control (play, pause, stop, next, prev, volume). - Enhanced docs: new usage examples and configuration guidance for openclaw.json. - Metadata updated: support for emoji, tags, and clearer author/version info.
v1.0.0
Initial release: Smart resume, LG TV fix, History log.
元数据
Slug jellyfin-control
版本 1.3.0
许可证
累计安装 1
当前安装数 1
历史版本数 5
常见问题

Jellyfin Control 是什么?

Control Jellyfin media server and TV. Search content, resume playback, manage sessions, control TV power and apps. Supports Home Assistant and direct WebOS b... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 963 次。

如何安装 Jellyfin Control?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install jellyfin-control」即可一键安装,无需额外配置。

Jellyfin Control 是免费的吗?

是的,Jellyfin Control 完全免费(开源免费),可自由下载、安装和使用。

Jellyfin Control 支持哪些平台?

Jellyfin Control 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Jellyfin Control?

由 Titunito(@titunito)开发并维护,当前版本 v1.3.0。

💬 留言讨论