Security audit
Security checks for vulnerabilities and agentic risk
This skill performs bounded business-location research using documented external services, with expected location-sharing and API-credit costs.
Provide only locations and route anchors you are comfortable sharing with Crawlora and the relevant mapping services. Protect your API key, monitor credit usage, and treat the results as preliminary research before making a lease decision.
Without declared permissions the skill's intent is opaque and cannot be validated.
Resolving each candidate with Google Maps or Apple Maps transmits the user's candidate address or coordinates to a third-party provider. The skill names those services but does not warn that user-supplied location data will be shared; the routing instructions at lines 37–39 similarly involve candidate locations and user-named anchors.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**22 endpoints across 6 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
esac
# Fixed, non-overridable: an env-configurable base URL would let anything that
# can set CRAWLORA_API_BASE redirect this key to an attacker-controlled host.
base="https://api.crawlora.net/api/v1"
method="GET"
body=""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
No suspicious patterns detected.