Security audit
Security checks for vulnerabilities and agentic risk
This skill is a focused anime and manga lookup helper that uses a disclosed third-party Crawlora API and does not show hidden persistence, privilege escalation, or unrelated data access.
Install only if you are comfortable using a Crawlora API key and sending anime/manga search terms, title IDs, and filter parameters to Crawlora. Do not use sensitive personal or confidential text as search input.
The skill uses shell-based helper commands but does not declare any tool restrictions or allowed-tools scope. That increases the chance an agent may invoke broader shell capabilities than intended, which weakens least-privilege boundaries and can enable misuse if the skill is combined with adversarial prompts or later modified scripts.
This skill is designed to send requests to https://api.crawlora.net, which means user prompts, search terms, title IDs, and metadata may be transmitted to an external service. In this context the transmission is functional rather than inherently malicious, but it still creates privacy, compliance, and data-exposure risk if sensitive inputs are passed through without notice or filtering.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**15 endpoints across 2 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The file explicitly instructs use of an external API with an API key but provides no user-facing disclosure that requests and potentially user-supplied queries will be sent to a third-party service. In an agent skill context, this is a real transparency and data-handling weakness because users may not realize their inputs are leaving the local/system boundary.