app-review-mining

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:44 PM UTC
• Version: 1.0.15

Overview

The skill is mostly a disclosed app-store data client, but its helper can make broader authenticated Crawlora API calls than the endpoint reference describes.

Install only if you are comfortable giving the skill access to your Crawlora API key and letting it send app-store research queries to Crawlora. Review use of scripts/crawlora.sh carefully, prefer documented GET endpoints, and avoid letting untrusted prompts supply raw paths, -X POST, or request bodies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:31
• Finding: Overbroad HTTP Method and Wildcard Route Authorization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 31–41, 49–75, and 113–119 **Vulnerability Type**: Excessive network capability and insufficient route validation **Risk Level**: Medium ### Vulnerable Code ```bash # Fixed, non-overridable: an env-configurable base URL would let anything that # can set CRAWLORA_API_BASE redirect this key to an attacker-controlled host. base="https://api.crawlora.net/api/v1" method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done ``` ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the app-review-mining skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the app-review-mining skill" >&2 exit 2 ;; esac case "$path" in /appstore/app) ;; /appstore/developer/*) ;; /appstore/editorial) ;; /appstore/editorial/category) ;; /appstore/list) ;; /appstore/privacy/*) ;; /appstore/ratings) ;; /appstore/reviews) ;; /appstore/search) ;; /appstore/similar) ;; /appstore/suggest/*) ;; /appstore/version-history/*) ;; /googleplay/app) ;; /googleplay/categories) ;; /googleplay/datasafety) ;; /googleplay/developer/*) ;; /googleplay/list) ;; /googleplay/permissions) ;; /googleplay/ratings) ;; /googleplay/reviews) ;; /googleplay/search) ;; /googleplay/similar) ;; /googleplay/suggest/*) ;; *) echo "path is not in the app-review-mining skill catalog" >&2 exit 2 ;; esac ``` ```bash if [ "$method" = "GET" ]; then # -G + --data-urlencode URL-encodes each value (so spaces etc. are safe). qs=() for kv in ${rest[@]+"${rest[@]}"}; do [ -n "$kv" ] || continue # curl treats both @file and name@file forms as local-file input for # --data-urlencode. Reject @ outrig ...[truncated 3351 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `POST` support because every endpoint documented for this Skill uses `GET`: ```bash if [ "$method" != "GET" ]; then echo "only GET is supported by the app-review-mining skill" >&2 exit 2 fi ``` 2. Replace broad wildcard route checks with exact route-template validation. Require precisely one nonempty path segment for parameterized routes and reject additional slashes. 3. Validate each path parameter according to the endpoint catalog: - Require numeric values for App Store track and developer IDs where documented. - Restrict package names and bundle IDs to an explicit safe character set. - Validate suggestion terms separately and URL-encode them rather than inserting raw text into a path. 4. Maintain a centralized route table mapping each operation to its exact HTTP method, path template, and parameter validation rules. Reject every request that does not match the table exactly. 5. Add automated negative tests covering unsupported methods, additional path segments, malformed IDs, encoded separators, empty path parameters, and attempts to access undocumented endpoints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill demonstrates shell-based execution via `scripts/crawlora.sh` but does not declare any `permissions` or `allowed-tools` scope. That creates an authorization and review gap: an agent may invoke shell access implicitly without the skill clearly advertising that capability, making it harder to enforce least privilege and increasing the risk of unexpected command execution paths.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file explicitly instructs users to call a remote API and include `x-api-key: $CRAWLORA_API_KEY`, but it does not include any warning about external network access or careful handling of credentials. Under the markdown-specific SQP-2 criteria, documentation should warn when behavior could affect privacy or system integrity, especially when credentials are involved.

Static analysis

No suspicious patterns detected.