qBittorrent Skill

Manage torrents with qBittorrent. Use when the user asks to "list torrents", "add torrent", "pause torrent", "resume torrent", "delete torrent", "check downl...

This skill appears to do what it says (control qBittorrent via its WebUI API), but there are several mismatches and things to check before installing: - Missing declared dependencies: the script uses curl and jq (and standard shell tools). Ensure those binaries are present; the skill metadata does not list them. - Config path inconsistency: SKILL.md, README, and the script reference different credential paths (~/.openclaw/... vs ~/.clawdbot/...). Confirm which path you must use or set QBIT_CONFIG to point to your file. - Credentials handling: the skill expects your qBittorrent username/password in a local JSON file or env vars. That means the agent/script will have full control over your torrents (including deleting files). If you proceed, store credentials with restrictive permissions (chmod 600) or prefer env vars and avoid leaving plaintext in shared locations. - Session cookie: the script writes a cookie file to /tmp; consider the transient exposure of that file on multi-user systems. - Network exposure: the skill will send commands to whatever QBIT_URL you provide. Ensure the qBittorrent WebUI is appropriately firewalled/whitelisted so credentials aren't usable remotely by other hosts. If you want to proceed, request that the skill author update the manifest to declare required binaries and clearly document the correct config path and credential behavior. If you cannot verify these things, treat the skill as untrusted because it will be able to control and delete torrents when given credentials.

Type: OpenClaw Skill Name: qbittorrent-skill Version: 1.0.0 The skill is a legitimate tool for managing qBittorrent via its WebUI API. It provides standard functionality such as listing, adding, and controlling torrents, as well as managing categories and speed limits. The code in `scripts/qbit-api.sh` is well-structured, uses standard tools like `curl` and `jq`, and restricts its network activity to the user-configured qBittorrent URL. No evidence of data exfiltration, malicious execution, or prompt injection was found.