auction-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:44 PM UTC
• Version: 1.0.8

Overview

The skill mostly matches its auction-research purpose, but its API helper can use a user's Crawlora key for broader Bonhams API requests than the documentation describes.

Review before installing. Use a limited Crawlora API key, avoid confidential client or business terms in queries, and prefer a revised helper that only allows the five documented GET route forms before curl is invoked.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:46
• Finding: Overbroad HTTP Method and Route Authorization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh:46-70` **Vulnerability Type**: Authenticated API scope is broader than the documented Skill requirements **Risk Level**: Medium ### Vulnerable Code ```bash # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the auction-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the auction-research skill" >&2 exit 2 ;; esac case "$path" in /bonhams/auctions/*) ;; /bonhams/auctions/*/lots) ;; /bonhams/auctions/search) ;; /bonhams/lots/*/*) ;; /bonhams/lots/search) ;; *) echo "path is not in the auction-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis The endpoint reference defines five Bonhams endpoints, all of which use the `GET` method. The helper nevertheless permits both `GET` and `POST`, allowing callers to submit authenticated POST requests that are not required by the Skill's documented functionality. The route allowlist is also broader than its comments imply. In a Bash `case` pattern, `*` matches slash characters as well as ordinary characters. Consequently, `/bonhams/auctions/*` accepts every non-empty suffix beneath `/bonhams/auctions/`, including paths with additional segments. It also subsumes the later auction-specific patterns, making those rules ineffective as scope restrictions. The fixed base URL prevents redirection of the API key to an attacker-controlled host, and the reviewed code does not expose the key on the curl command line. However, overbroad method and path authorization allows an untrusted caller or compromised agent workflow to use the victim's ...[truncated 1345 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove POST support because every endpoint documented for this Skill is GET-only: ```bash if [ "$method" != "GET" ]; then echo "only GET is supported by the auction-research skill" >&2 exit 2 fi ``` 2. Replace slash-permissive glob patterns with segment-aware validation. Validate dynamic identifiers separately and reject `/`, empty values, and unexpected characters. 3. Allow only these exact route forms: ```text /bonhams/auctions/search /bonhams/auctions/{id} /bonhams/auctions/{id}/lots /bonhams/lots/search /bonhams/lots/{auctionId}/{lotNumber} ``` 4. Check static routes before dynamic routes so values such as `search` cannot be ambiguously interpreted as identifiers. 5. Apply conservative character and length restrictions to `id`, `auctionId`, and `lotNumber`, based on the actual Bonhams identifier formats. 6. Add negative tests covering POST requests, extra path segments, empty identifiers, encoded separators, duplicate separators, traversal syntax, query fragments, and undocumented paths. Verify that every such request is rejected before curl is invoked. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill appears to rely on a helper with shell-capable execution but does not declare any tool scope, permissions, or allowed-tools constraints. That omission increases the attack surface because an agent may invoke broader local execution capabilities than are necessary, making misuse or prompt-injection-driven command execution harder to contain.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Get a Crawlora API key at [crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills).
- Set `CRAWLORA_API_KEY` in the environment before running the helper.
- The helper reads `CRAWLORA_API_KEY` from the environment and sends requests to `https://api.crawlora.net/api/v1`.

## How it works

• Confidence: 86% confidence
• Finding: The skill instructs the agent to read an API key from the environment and transmit requests to an external third-party service. While that is consistent with the skill's purpose, it still creates a real data egress channel and exposes secrets to an external dependency, which becomes dangerous if the helper sends more than intended data or if the endpoint/service is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**5 endpoints across 1 platform group(s).**

• Confidence: 82% confidence
• Finding: The skill is explicitly designed to transmit query parameters to an external third-party service at api.crawlora.net using an API key. That creates a real data-exposure boundary: if users provide sensitive or proprietary information in search terms, it will leave the local environment and be disclosed to the external provider. The context makes this moderately risky rather than highly risky because the skill's intended purpose is public auction research, but the documentation does not constrain inputs or warn about external transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: This markdown file says the endpoints are used via `scripts/crawlora.sh` but does not describe any specific activation phrases, boundaries, or exclusion conditions for invoking the skill. In a skill reference document, that omission can make invocation scope overly broad or ambiguous compared with a narrowly defined trigger description.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Line L07 states that calls require the header `x-api-key: $CRAWLORA_API_KEY`, which implies use of sensitive credentials and external network transmission. The markdown does not warn users that the skill will make outbound API requests using an environment-stored credential, which is the kind of privacy/system-impact behavior this rule covers for markdown files.

Static analysis

No suspicious patterns detected.