Unified command-line interface for Radarr, Sonarr, and Lidarr. Search, add, and manage movies (Radarr), TV shows (Sonarr), and music (Lidarr) with calendar view and health monitoring.
Security Analysis
high confidenceThe skill does what it says: a local CLI wrapper for Radarr, Sonarr and Lidarr that uses local config files and curl/jq to call those services; its requirements and behavior are consistent with its description.
Name/description match the included scripts: the code provides unified commands for Radarr/Sonarr/Lidarr and only requires curl/jq. It uses a home-directory JSON config (~/.openclaw/credentials/...) to store service URLs and API keys, which is coherent for this purpose.
Runtime instructions and scripts only call configured service endpoints, read/write temporary files in /tmp, and read the user's per-skill config files under $HOME. There are no calls to unrelated system files, hidden endpoints, or external exfiltration in the code; all network calls go to the user-configured URLs (and printed links to TMDB/TVDB/MusicBrainz are only for display).
There is no install spec (no remote downloads); the skill is delivered as script files. This is low-risk, but note that the package contains executable shell scripts — review them before running if you don't trust the publisher.
The skill requests no environment variables; instead it expects API keys/URLs in JSON configs under ~/.openclaw/credentials/arr-all/config.json or per-service legacy files. This is proportionate, but the SKILL metadata did not enumerate these file-based credentials explicitly — ensure you store API keys only for services you trust.
The skill does not request always:true and makes no changes to other skills or system-wide configs. It runs on demand and only interacts with configured services and temporary files.
Guidance
This skill appears to be a straightforward local CLI wrapper for Radarr, Sonarr, and Lidarr. Before installing: (1) review the included scripts (they are shell scripts that will run on your machine); (2) ensure you only put API keys for trusted local services into ~/.openclaw/credentials/... (the skill reads those files rather than environment variables); (3) be aware the tool will perform POST/PUT/DELETE operations against the configured apps (adding/removing media), so run it with accounts that have only the permissions you intend; (4) because there is no install step, just placing/executing these scripts runs code from the package — trust the publisher or inspect the files first.
Latest Release
v1.0.0
Initial release of arr-all – a unified CLI for Radarr, Sonarr, and Lidarr. - Supports searching, adding, and managing movies (Radarr), TV shows (Sonarr), and music (Lidarr). - Calendar view for upcoming releases across all supported apps. - Health and connection status checks for all apps from one command. - Works with a unified config file or existing per-app configs. - Provides both cross-app and app-specific commands.
More by @rappo
Published by @rappo on ClawHub
