Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed helper for querying public ATS job boards through Crawlora, with no hidden persistence, privilege escalation, or unrelated data access found.
Install only if you are comfortable sending public company/ATS slugs and job-board query parameters to Crawlora. Keep CRAWLORA_API_KEY in environment or secret storage, do not hardcode it, and avoid using the skill for private candidate, employee, or internal recruiting data.
The skill invokes shell-based helper commands (scripts/crawlora.sh ...) but does not declare any permissions or allowed-tools scope. That creates an authorization gap where an agent may execute shell/network actions without an explicit least-privilege contract, increasing the risk of unintended command execution or outbound access.
The skill is designed to send requests, including an environment-sourced API credential, to an external third-party service (api.crawlora.net). While this is core functionality rather than overtly malicious behavior, it still creates a real data egress boundary and dependency on an external service that could expose queried company/job data or mishandle credentials if the integration is not tightly controlled.
- Get a free Crawlora API key (2,000 credits/mo, no card) at [https://crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills).
- Set `CRAWLORA_API_KEY` in the environment before running the helper.
- The helper reads `CRAWLORA_API_KEY` from the environment and sends requests to `https://api.crawlora.net/api/v1`. Missing/invalid key → `401`.
## How it works
The documentation instructs use of an API key and outbound calls to a third-party service but does not pair that with any user-facing notice about network access, external data transmission, or secret-handling expectations. In agent settings, this can lead to silent transmission of user-supplied company queries and operational metadata to an external API without adequate transparency or guardrails.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file describes how to call the skill's endpoints but does not specify any narrow invocation conditions, exclusions, or negative examples. In markdown files, missing specificity around trigger scope can lead to overly broad or unintended activation if this reference is used as part of skill-selection metadata or documentation.
No suspicious patterns detected.