Crawleo Web Search

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:46 PM UTC
• Version:
  1.0.1

Overview

This is a disclosed Crawleo search and crawling integration that sends user-chosen queries or URLs to Crawleo using an API key, with no evidence of hidden persistence, local data access, or credential leakage.

Install this only if you trust Crawleo and the publisher. Treat CRAWLEO_API_KEY as a real account credential, monitor usage and credits, and avoid sending confidential search terms, private/internal URLs, or access-controlled pages unless you are comfortable sharing them with Crawleo.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The contract explicitly defines external API transmission of user queries, URLs, and authentication material, but it does not include any user-facing disclosure, consent, or data-handling warning. In an agent setting, this can cause sensitive prompts, internal URLs, or proprietary targets to be sent to a third-party service without the user clearly understanding that external transmission will occur.

VirusTotal

66/66 vendors flagged this skill as clean.