by fancydirty
Agent-driven media library for your cloud drives (Quark 夸克 / 115 / 光鸭 GuangYa / 123网盘 / 天翼 Tianyi)
# Add to your Claude Code skills
git clone https://github.com/fancydirty/mediary-scoutGuides for using ai agents skills like mediary-scout.
Last scanned: 9/8/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@electron/node-gyp: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@electron/rebuild: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "app-builder-lib: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "builder-util: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "builder-util-runtime: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`",
"severity": "high"
},
{
"type": "npm-audit",
"message": "cacache: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dmg-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron: Electron has ASAR Integrity Bypass via resource modification",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-builder-squirrel-windows: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "electron-publish: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "extract-zip: extract-zip unvalidated symlink path traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
"severity": "high"
},
{
"type": "npm-audit",
"message": "make-fetch-happen: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
"severity": "high"
},
{
"type": "npm-audit",
"message": "next: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-gyp: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
"severity": "high"
},
{
"type": "npm-audit",
"message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "undici: undici vulnerable to downstream response desynchronization via retry interceptor",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-09-08T08:38:06.734Z",
"npmAuditRan": true,
"pipAuditRan": false,
"promptInjectionRan": true
}mediary-scout is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by fancydirty. Agent-driven media library for your cloud drives (Quark 夸克 / 115 / 光鸭 GuangYa / 123网盘 / 天翼 Tianyi). It has 1,397 GitHub stars.
mediary-scout failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/fancydirty/mediary-scout" and add it to your Claude Code skills directory (see the Installation section above). mediary-scout ships a SKILL.md manifest, so compatible agents can discover and load it automatically.
mediary-scout is primarily written in TypeScript. It is open-source under fancydirty on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh mediary-scout against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Before any clawd-media-track reasoning or tool use:
references/00-bootstrap-init.mdreferences/01-environment-contract.mdreferences/02-global-constraints.mdreferences/03-methods-reference.md[Type X - Step N]DO NOT:
This system can make destructive or rate-limit-sensitive 115 calls if used carelessly.
Read the references in order and follow the checklist for the current task type. Do not improvise around them.
In particular:
flatten_directory() is only valid on final landing directories:
MOVIES_CIDSeason <number>list_files() is shallow by default. Recursive scans on protected directories are blocked for safety.SAFETY_VIOLATION, stop and report the exact target/path instead of retrying with guesses.This skill is split for progressive loading.
Read only what is needed, but never skip required safety/rules for the current task type.
For any clawd-media-track task, read in this order:
references/00-bootstrap-init.md (init gate for bootstrap Step 1 and Step 2)references/01-environment-contract.md (required config contract after bootstrap)references/02-global-constraints.md (hard safety rules + execution protocol)references/03-methods-reference.md (allowed module methods only)Then route by task type:
references/05-type1-checklist.mdreferences/06-type2-checklist.mdreferences/07-type3-checklist.mdRead additional references when needed:
references/04-error-and-dedup-rules.mdreferences/08-directory-and-mistakes.md.each(); DO NOT slice/sample/top-N themIf any hard rule is violated, stop and report failure instead of improvising.
./.venv/bin/pythonreferences/00-bootstrap-init.mdreferences/01-environment-contract.mdreferences/02-global-constraints.mdreferences/03-methods-reference.mdreferences/04-error-and-dedup-rules.mdreferences/05-type1-checklist.mdreferences/06-type2-checklist.mdreferences/07-type3-checklist.mdreferences/08-directory-and-mistakes.mdThis refactor keeps original procedural content but routes detailed material into references for reliability and context efficiency.
You ask for a movie, show, or anime; an LLM agent scouts resources across your indexers, transfers the best match into your own 115 / Quark / 光鸭 drive, verifies what landed, and keeps tracking what's still missing.

Above: the read-only live demo — search → 获取 → the agent works through search, transfer, and verification.
| Platform | Download | Notes |
|---|---|---|
| macOS (Apple Silicon) | DMG → Releases | Signed + notarized, no Gatekeeper warning |
| Windows (x64) | EXE installer → Releases | Unsigned — SmartScreen will prompt, click "run anyway" |
No Docker, no Postgres, no terminal. The app bundles its own SQLite data layer and runs the full engine inside an Electron shell.
Every release is machine-verified before it ships: CI installs the freshly-built Windows package on a clean runner, boots the real app, and requires an HTTP 200 health response, while the macOS build must pass native-ABI verification, signing, and notarization. Both platforms are published together in a single final step — if either gate fails, neither asset is uploaded, so a broken build can't reach the Releases page.
cp .env.example .env # optional — most config can be set in the UI
docker compose up -d
Then open http://<host>:3000 and configure in Settings. Full walkthrough: docs/deploy.md.
🇨🇳 Can't reach Docker Hub (mainland China)? See docs/deploy.md → registry mirror.
| Desktop App | Docker | |
|---|---|---|
| Best for | Personal use, Mac/Windows | NAS, server, 24/7 monitoring |
| Setup | Download + open | docker compose up -d |
| Database | SQLite (default) | Postgres (default; SQLite via MEDIA_TRACK_SQLITE_PATH) |
| Agent API | ✅ | ✅ |
| Always-on patrol | ❌ (runs when app is open) | ✅ |
| Multi-user | ❌ | ✅ |
| Remote access | Local only | Tailscale / Cloudflare Tunnel |
Both paths share one codebase — all product logic is identical. The data layer (SQLite vs Postgres) is selected by the MEDIA_TRACK_SQLITE_PATH env var, not the process shell — desktop sets it automatically, Docker defaults to Postgres.
| Search → acquire — find a title, hit 获取, the agent takes over | ![]() |
| Library wall — what you have, per drive, with missing / airing badges | ![]() |
| Show detail — season coverage, gaps, tracking state | ![]() |
| Realtime activity — a live queue + agent action ticker while it works | ![]() |
| Notifications — per-acquisition + daily digest, multi-channel push | ![]() |
| Settings — drives, quality, language, LLM (BYO-key), Prowlarr, PanSou | ![]() |
Multiple drives appear as a workspace switcher with per-brand icons:

Most "media automation" either searches well but doesn't know what you're actually missing, or moves files but never verifies what landed. Mediary Scout treats acquisition as a state problem, driven by an agent that acts from evidence, not vibes:
Five Chinese cloud drives, each a first-class workspace — ordered by how many PanSou resources each can consume (115 and 123 are dual-path: own share links and magnets):
quark) — share-link transfer (no magnet web API). The largest share pool on PanSou by far.pan123) — dual-path like 115: share-link transfer (123pan.com/s/…) and magnets via its native offline-download API (resolve → submit → poll). A magnet is a magnet — whether it came from PanSou or a Prowlarr indexer. QR login (~90-day token) or paste a token. Free accounts can transfer (server-side copy costs no download quota). Setup guidepan115) — full support: 115 share links and magnets (built-in offline path, plus Prowlarr).guangya) — Xunlei-family drive; magnet / offline-download only (transfers magnet/ed2k/BT via its offline-task API — it does not transfer share links in v1). Token auth. Pairs well with Prowlarr. Setup guidetianyi) — share-link transfer (cloud.189.cn/t/…); QR login or paste an SSON cookie. Smallest share pool on PanSou today (weak for movies, workable for shows/anime). Setup guideMeasured share volume per drive (2026-07 point-in-time sample: six popular titles across movie / drama / anime, one PanSou instance with curated channels — your channels will vary):
| Drive | Own share links | Magnets it can also eat | Usable pool |
|---|---|---|---|
| Quark | 523 | — | 523 |
| 123 | 120 | 361 | 481 |
| 115 | 100 | 361 | 461 |
| 光鸭 | — | 361 | 361 |
| 天翼 | 63 | — | 63 |
New brands plug into a storage-brand registry; the bulk of adding one is a drive client + a storage executor for that drive's transfer API.
Both the desktop app and the container expose a local HTTP API that lets any coding agent (Claude Code, Codex, opencode, …) operate Mediary Scout without opening the GUI — change settings, trigger acquisitions, check download progress.
Desktop: automatic — on first launch the app writes a discovery file to ~/.mediary/agent.json. Container: set MEDIA_TRACK_AGENT_TOKEN env var to opt in.
Install the agent skill:
mkdir -p ~/.claude/skills/ && cp -r skills/mediary-scout ~/.claude/skills/ # or ~/.codex/skills/, ~/.config/opencode/skills/
Then tell your agent things like "帮我找进击的巨人第二季" or "蜘蛛侠下好了吗" or "把画质改成 high". See skills/mediary-scout/SKILL.md for the full trigger list.
| Method | Path | Purpose |
|---|---|---|
GET |
/api/agent/config |
Read settings (secrets masked) |
PUT |
/api/agent/config |
Partial update (rejects masked *** writes) |
POST |
/api/agent/acquire |
Search TMDB → queue (409 on ambiguity) |
POST |
/api/agent/patrol |
Trigger a patrol sweep |
GET |
/api/agent/library |
Tracked titles + missing episodes |
GET |
/api/agent/activity |
Active queue + recent notifications |
All require Authorization: Bearer <token>. No token configured → 404 (invisible). Wrong/missing token → 401.
A web app enqueues work; a long-running worker drives a sandboxed agent that has narrow, audited powers while the deterministic workflow owns every side effect and re-reads real state to verify.
flowchart LR
UI["Web UI<br/>(Next.js)"] -->|enqueue| Q["Postgres / SQLite<br/>+ run state"]
Q --> W["In-process worker"]
W --> AG["V2 sandbox agent"]
AG -->|search| SRC["PanSou / Prowlarr"]
AG -->|transfer| DR["Quark / 115 / 光鸭 / 123 / 天翼 drive"]
AG -->|read back| DR
AG -->|verify + mark| Q
Q -->|realtime| UI
CRON["Scheduled sweep"] -->|gaps only| Q
🔭 Try it live: demo.mediaryscout.app
A public, read-only demo — mock drives, real TMDB search across the whole catalog, and a