Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed public app-store research helper that sends user-chosen queries to the Crawlora API and does not show hidden execution, persistence, or destructive behavior.
Install only if you are comfortable using Crawlora as a third-party API provider. Treat app IDs, search terms, review requests, locale choices, and your Crawlora API key as data sent to that provider; avoid sending sensitive internal research targets unless that matches your privacy expectations.
The skill documents shell-based helper usage but does not declare any tool scope or allowed-tools restrictions. This creates a permission-boundary ambiguity: an agent may invoke shell access more broadly than intended, increasing the chance of unintended command execution or misuse in environments where shell access is sensitive.
The skill is explicitly designed to send requests to an external service (api.crawlora.net) using an API key, which creates a real data egress and trust-boundary crossing risk. In the context of a research skill this is expected, but it is still security-relevant because any user-supplied app IDs, search terms, or research targets are transmitted to a third party and the skill depends on secure handling of the CRAWLORA_API_KEY.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**38 endpoints across 3 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The endpoint description states Defaults: country=us, lang=en, which encodes a specific locale choice in natural-language documentation. Under the policy, forcing a specific language or locale without user opt-in can be a violation when no alternative-selection guidance or justification is provided.
This line specifies Defaults: country=us, lang=en, which imposes a particular locale by default in the skill's natural-language behavior description. The file does not indicate that users can opt into a different default or that this locale restriction is required for a region-specific purpose.
The description says country and lang default to us and en, which is a natural-language locale policy choice. Because the documentation does not frame this as user-configurable behavior or a justified region-specific constraint, it may violate the requirement not to force a specific language without opt-in.
This line declares Defaults: num=50, country=us, lang=en, embedding a specific locale default into the skill documentation. That can conflict with the policy against forcing a language or locale absent explicit user choice or documented justification.
The text sets country=us, lang=en as defaults, which is a locale-specific assumption in natural language. No user opt-in, configurability guidance, or region-specific justification is provided alongside that default.
The line specifies Defaults: num=50, country=us, lang=en, making a fixed locale the implied normal behavior. The policy calls for avoiding forced language/locale choices unless users can opt in or the constraint is clearly justified.
This endpoint description includes Defaults: num=50, country=us, lang=en, which presents a specific locale as the default operating mode. There is no explicit opt-in or rationale for enforcing that language/locale choice in the documentation.
The description states Defaults: country=us, lang=en, which is a locale policy choice expressed in natural language. Because no opt-in or business justification is provided, this may violate the rule against forcing a specific language or locale.
This line sets country=us, lang=en as defaults, which imposes a specific locale assumption in the documentation. The file does not mention user selection, opt-in, or a justified regional scope for that choice.
The phrase Defaults: country=us, lang=en embeds a fixed locale default into the endpoint behavior description. Without user opt-in or a documented reason, that can be considered a natural-language locale policy violation.
The documentation sets country=us, lang=en as defaults for reviews, which is a specific locale choice stated as normal behavior. The file does not provide opt-in language or a region-specific justification for that default.
The line says Defaults: num=30, country=us, lang=en, expressing a specific locale as the default configuration. That can conflict with the policy unless users are given a choice or the locale restriction is documented as necessary.
This endpoint description states that country and lang default to us and en, which is a locale-specific assumption in natural-language documentation. No user opt-in mechanism or region-specific rationale is described.
The description says country and lang default to us and en, which presents a fixed locale as the default behavior. Under the policy, that should be user-selectable or clearly justified rather than assumed.