Pt Site

Search and download torrents from NexusPHP-based PT sites, then add to qBittorrent. Use when user wants to search a specific PT site, download torrent, or fi...

This skill largely does what it says (search a NexusPHP tracker, download .torrent files, add to qBittorrent) but there are some practical and privacy concerns you should address before installing: - Confirm where your tracker credentials/cookies will be stored: SKILL.md and the script expect ~/.clawdbot/credentials/pt-site/sites.json containing cookie values (c_secure_uid / c_secure_pass). That file contains sensitive authentication tokens; only use this skill with trackers you trust and store the file with restrictive permissions (chmod 600). - The skill metadata did not declare required config paths or binaries. The included script requires jq and the instructions call curl and a qBittorrent helper script (./scripts/qbit-api.sh) which is not bundled. Install jq and ensure qbit-api.sh exists and is trustworthy before running the skill. - Review the qbit-api.sh helper and any other referenced scripts (not provided here) to ensure they do not exfiltrate secrets or send data to unexpected endpoints. - Because the skill sends authentication cookies in HTTP requests, be mindful of network monitoring and avoid running this with untrusted proxies or networks. - If you need higher assurance: ask the skill publisher for a homepage or source repository, request they declare required config paths/binaries in metadata, and provide the qBittorrent helper or integration details so you can audit all code that will run. If the author supplies an explicit list of required binaries (jq, curl), declares the credential file path in metadata, and either bundles or documents the qBittorrent helper, confidence in this skill would increase. Without those clarifications, treat the skill as coherent but sloppy and proceed cautiously.

Type: OpenClaw Skill Name: pt-site Version: 1.0.0 The `scripts/pt-search.sh` file contains a shell injection vulnerability. The `$SITE` variable, which is derived from user input, is directly interpolated into a `jq` command (`jq -r ".sites[\"$SITE\"]" "$CRED_FILE"`). A malicious `$SITE` value could break out of the `jq` string and execute arbitrary commands, leading to potential Remote Code Execution. While the skill's stated purpose involves handling sensitive credentials (cookies) and performing network requests, which carries inherent risk, there is no clear evidence of intentional malicious behavior like data exfiltration or persistence mechanisms.