Trakt.tv

Interact with the Trakt API to manage your watchlist, collection, ratings, and discover content

This skill appears to be a straightforward Trakt API helper. Before installing: 1) Verify the skill source (homepage is missing and README references a placeholder GitHub URL), since you will store API secrets for your Trakt account. 2) Inspect get_trakt_token.sh before running it (it performs OAuth against api.trakt.tv and prints the tokens and a JSON snippet to add to ~/.openclaw/openclaw.json). 3) Ensure jq and curl are installed — the script will fail without jq. 4) Consider creating a dedicated Trakt application name for this skill and treat the client secret/access token as sensitive (store openclaw.json with restrictive file permissions). 5) Note the metadata omission: TRAKT_REFRESH_TOKEN is recommended by the skill but not declared in requires.env; add it if you want token refresh to work. If you are comfortable reviewing the small script and trust the skill author, it is coherent with its stated purpose.

Type: OpenClaw Skill Name: trakt-tv Version: 1.0.0 The skill bundle is benign, providing a legitimate integration with the Trakt API. All `curl` commands in `SKILL.md` and the `get_trakt_token.sh` script exclusively target the official `api.trakt.tv` domain for authentication and API interactions. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the agent to subvert its intended behavior. The `SKILL.md` instructions guide the agent on standard API usage, and the `get_trakt_token.sh` script facilitates a standard OAuth 2.0 flow for token acquisition.