← 返回 Skills 市场

Sonarr Fixed

Name: Sonarr Fixed
Author: frannunpal

作者 frannunpal · GitHub ↗ · v1.0.2

cross-platform ⚠ suspicious

494

总下载

当前安装

版本数

在 OpenClaw 中安装

/install sonarr-fixed

功能描述

Search and add TV shows to Sonarr. Supports monitor options, search-on-add. FORK of jordyvandomselaar/sonarr with fixed metadata.

安全使用建议

This skill looks like a straightforward Sonarr helper, but check two things before installing or running it: (1) Decide whether you will use the config file (~/.openclaw/credentials/sonarr/config.json) or environment variables. The script prefers values from the config file and will overwrite env vars if the config exists (contrary to the SKILL.md claim that env vars override). (2) Protect your Sonarr API key—store the config file with restrictive permissions and only provide the minimum privileges required by your Sonarr instance. Also note that the registry metadata in the package summary appears malformed ("[object Object]") — this looks like a harmless metadata serialization bug but you may want to confirm the source/owner before trusting the skill. If you need higher assurance, review the script (scripts/sonarr.sh) line-by-line and test it in a controlled environment.

功能分析

Type: OpenClaw Skill Name: sonarr-fixed Version: 1.0.2 The `scripts/sonarr.sh` script is vulnerable to shell injection. The `SONARR_URL` and `SONARR_API_KEY` variables, sourced from `~/.openclaw/credentials/sonarr/config.json` or environment variables, are used directly within `curl` commands without proper shell sanitization. If these configuration values contain shell metacharacters (e.g., `$(command)`), it could lead to arbitrary command execution or data exfiltration, making it a significant vulnerability. While the `search` query parameter is URL-encoded, the core API endpoint and key are not protected.

能力评估

✓ Purpose & Capability

The skill is a Sonarr API wrapper: it uses curl/jq to call a Sonarr instance API and requires a Sonarr URL and API key. Those requirements align with the described purpose of searching/adding/removing TV shows.

ℹ Instruction Scope

SKILL.md instructs creating ~/.openclaw/credentials/sonarr/config.json (and optionally using SONARR_URL/SONARR_API_KEY to override). The included script implements the described commands (search, add, remove, config) and prints TVDB links as required. However, the SKILL.md claims env vars 'override' the config file but the script reads the config file first and will overwrite any pre-set environment variables if the config file exists (i.e., config takes precedence). This is a functional mismatch between docs and implementation.

✓ Install Mechanism

This is an instruction-only skill with a small shell script (no install spec). No network downloads or packages are installed by the skill itself, which lowers installation risk.

ℹ Credentials

The skill only needs a Sonarr URL and API key (stored in the config file or environment). Those are proportional to its function. Two metadata issues to note: the registry summary in the prompt shows malformed/placeholder entries ("[object Object]") for required env/config, and SKILL.md marks the env vars optional but the script requires the url and apiKey to be present (via config or env). Confirm which mechanism you prefer and ensure the API key is stored securely (correct file permissions).

✓ Persistence & Privilege

The skill does not request persistent 'always' inclusion, and it does not modify other skills or global settings. It only reads the declared config path and calls the Sonarr API.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install sonarr-fixed
安装完成后，直接呼叫该 Skill 的名称或使用 /sonarr-fixed 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.2

- Forked from jordyvandomselaar/sonarr; metadata declarations are fixed. - Corrected required config paths and credentials in metadata. - Enhanced documentation for setup, config, and workflow instructions. - No functional changes; update primarily clarifies setup and ensures proper credential handling.

元数据

Slug sonarr-fixed

版本 1.0.2

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Sonarr Fixed 是什么？

Search and add TV shows to Sonarr. Supports monitor options, search-on-add. FORK of jordyvandomselaar/sonarr with fixed metadata. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 494 次。

如何安装 Sonarr Fixed？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install sonarr-fixed」即可一键安装，无需额外配置。

Sonarr Fixed 是免费的吗？

是的，Sonarr Fixed 完全免费（开源免费），可自由下载、安装和使用。

Sonarr Fixed 支持哪些平台？

Sonarr Fixed 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Sonarr Fixed？

由 frannunpal（@frannunpal）开发并维护，当前版本 v1.0.2。