Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora API helper for company identity reconciliation, with external API use that fits its stated purpose.
Install only if you are comfortable sending the company names, domains, IDs, URLs, and lookup targets you provide to Crawlora's external API using your Crawlora API key. Keep usage bounded to public or approved business identity data, and review mappings before applying them to operational systems.
The skill invokes shell-based capability via a bundled script but does not declare any explicit tool restrictions or permissions scope. That increases the chance an agent can execute broader shell actions than intended, and reviewers cannot verify from the manifest that execution is limited to the documented Crawlora workflow.
The skill is explicitly designed to send data to an external API service using an API key, which creates a real external-transmission boundary. If sensitive inputs are passed through this workflow without minimization or policy controls, company lists, identifiers, and user-provided reconciliation targets could be disclosed to a third party.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**10 endpoints across 7 platform group(s).**
The manifest describes a skill for reconciling company and brand identities across specific sources such as public domains, LinkedIn, SEC, and employer records. The documented bing_search endpoint adds a general-purpose web search capability that is materially broader than identity reconciliation against those named sources and could be used for unrelated discovery tasks.
The manifest frames the skill around reconciling company identities using Crawlora public domains, LinkedIn profiles, SEC registrants, and employer records. The web_scrape endpoint is a generic URL scraping tool that can fetch arbitrary public pages in multiple formats, which is a broader capability than the stated reconciliation purpose and not clearly limited to the declared source types.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
The Bing search description says locale defaults to country=us and lang=en-us, and the parameter list repeats those defaults. This is a natural-language locale policy concern because it prescribes a specific language/region behavior by default without documenting user opt-in or emphasizing user-controlled locale selection.
No suspicious patterns detected.