openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: clawarr-suite flagged as suspicious #154

New Issue
Open
opened 2026-02-15 17:15:57 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:57 -05:00
Owner
Copy Link
Copy Source

Originally created by @omiron33 on GitHub (Feb 13, 2026).

Skill

  • Slug: clawarr-suite
  • Version: 1.0.0
  • Publisher: @omiron33

What it does

ClawARR Suite is a skill for managing self-hosted media stacks (Sonarr, Radarr, Prowlarr, Plex, etc.). It contains 24 bash scripts for API interaction, 8 reference docs, and a setup UI.

Likely flag triggers

1. eval in scripts/setup.sh (lines 94, 158)

Used to dynamically set environment variables during setup:

eval "${upper_name}_PORT=$port"
eval "${upper_app}_KEY=$key"

These are safe — they set shell variables from sanitized values (port numbers and API keys extracted from JSON responses). No user-controlled code execution.

2. WebRTC RTCPeerConnection in ui/index.html

Used for zero-config local network autodiscovery — detects the user's LAN subnet so they don't have to manually enter their server IP. This is a common pattern for LAN service discovery UIs. No data leaves the browser; the detected IP is only used to scan local network ports.

3. Docker commands in companion service scripts

Scripts like unpackerr.sh, recyclarr.sh, kometa.sh use docker inspect, docker logs, docker restart to manage Docker containers. This is the core functionality — the skill manages Docker-based media services.

4. curl to local network endpoints

All scripts use curl to communicate with local *arr service APIs (Sonarr, Radarr, etc.) via their HTTP APIs. This is how these services are designed to be managed.

5. Token/API key references

The scripts handle API keys for Sonarr, Radarr, Plex, etc. — this is inherent to managing authenticated APIs. No keys are hardcoded; all are passed via environment variables.

Request

Please review and unflag. All patterns are standard for a media server management tool. Happy to make changes if specific patterns need adjustment.

Originally created by @omiron33 on GitHub (Feb 13, 2026). ## Skill - **Slug:** clawarr-suite - **Version:** 1.0.0 - **Publisher:** @omiron33 ## What it does ClawARR Suite is a skill for managing self-hosted media stacks (Sonarr, Radarr, Prowlarr, Plex, etc.). It contains 24 bash scripts for API interaction, 8 reference docs, and a setup UI. ## Likely flag triggers ### 1. `eval` in `scripts/setup.sh` (lines 94, 158) Used to dynamically set environment variables during setup: ```bash eval "${upper_name}_PORT=$port" eval "${upper_app}_KEY=$key" ``` These are safe — they set shell variables from sanitized values (port numbers and API keys extracted from JSON responses). No user-controlled code execution. ### 2. WebRTC `RTCPeerConnection` in `ui/index.html` Used for zero-config local network autodiscovery — detects the user's LAN subnet so they don't have to manually enter their server IP. This is a common pattern for LAN service discovery UIs. No data leaves the browser; the detected IP is only used to scan local network ports. ### 3. Docker commands in companion service scripts Scripts like `unpackerr.sh`, `recyclarr.sh`, `kometa.sh` use `docker inspect`, `docker logs`, `docker restart` to manage Docker containers. This is the core functionality — the skill manages Docker-based media services. ### 4. `curl` to local network endpoints All scripts use `curl` to communicate with local *arr service APIs (Sonarr, Radarr, etc.) via their HTTP APIs. This is how these services are designed to be managed. ### 5. Token/API key references The scripts handle API keys for Sonarr, Radarr, Plex, etc. — this is inherent to managing authenticated APIs. No keys are hardcoded; all are passed via environment variables. ## Request Please review and unflag. All patterns are standard for a media server management tool. Happy to make changes if specific patterns need adjustment.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#154
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?