competitor-intelligence

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 12:57 PM UTC
• Version: 1.0.8

Overview

This skill is a disclosed competitor-research helper that sends selected queries and public URLs to Crawlora, with no evidence of hidden persistence, local data theft, or destructive behavior.

Install only if you are comfortable sending competitor names, search terms, public page URLs, and extraction requests to Crawlora using your Crawlora API key. Avoid sending confidential internal strategy, secrets, customer data, or non-public documents, and prefer explicit locale and narrow source choices for sensitive briefs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/crawlora.sh:68
• Finding: Incomplete API Route Allowlist Permits Undocumented Nested Paths## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 68-79 **Vulnerability Type**: Incomplete route allowlist caused by overbroad shell wildcard matching **Risk Level**: Low **Vulnerable Code**: ```sh case "$path" in /bing/search) ;; /capterra/product) ;; /capterra/product/reviews) ;; /capterra/search) ;; /datasets/jobs/companies) ;; /datasets/jobs/search) ;; /extract) ;; /producthunt/product/*) ;; /producthunt/product/*/alternatives) ;; /producthunt/product/*/launches) ;; /producthunt/search) ;; /similarweb/search) ;; /similarweb/web/*) ;; /trustpilot/business-units/search) ;; /trustpilot/business/*) ;; /trustpilot/business/*/reviews) ;; /web/scrape) ;; *) echo "path is not in the competitor-intelligence skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis Shell `case` wildcard `*` matches slash characters and therefore does not restrict a dynamic identifier to one URL path segment. Patterns such as `/producthunt/product/*`, `/similarweb/web/*`, and `/trustpilot/business/*` consequently accept arbitrary nested suffixes. The broad Product Hunt and Trustpilot patterns also precede their more specific alternatives, launches, and reviews patterns. Because `case` stops at the first match, the narrower entries do not provide additional enforcement. This undermines the script's stated route restriction: a path below one of the accepted prefixes can pass validation even when it is absent from the documented 17-endpoint catalog. The fixed HTTPS API origin prevents this flaw from redirecting the API key to an attacker-controlled host. ### Attack Path 1. An attacker or untrusted caller supplies an undocumented nested path, such as: ```sh scripts/crawlora.sh /producthunt/product/example/undocumented ``` 2. The path passes the preliminary syntax checks because it contains none of the explicitly rejected cha ...[truncated 1087 chars]
• Remediation: ## Remediation Suggestions 1. Replace glob-based path authorization with strict regular-expression validation that permits dynamic identifiers as exactly one path segment. 2. Explicitly allow only the documented route shapes. For example: ```sh if [[ "$path" =~ ^/producthunt/product/[^/]+$ ]] || [[ "$path" =~ ^/producthunt/product/[^/]+/(alternatives|launches)$ ]] || [[ "$path" =~ ^/similarweb/web/[^/]+$ ]] || [[ "$path" =~ ^/trustpilot/business/[^/]+$ ]] || [[ "$path" =~ ^/trustpilot/business/[^/]+/reviews$ ]]; then : else # Check separately for exact, non-parameterized routes or reject. exit 2 fi ``` 3. Define an explicit allowed HTTP method for each route rather than allowing both GET and POST globally. The documented scrape and extract endpoints should accept POST, while the remaining catalog endpoints should accept GET. 4. Validate dynamic identifiers against their expected character sets and length limits where those constraints are known. 5. Add negative tests covering extra segments, including `/producthunt/product/id/unknown`, `/similarweb/web/domain/extra`, and `/trustpilot/business/slug/reviews/extra`. 6. Retain the fixed HTTPS origin and existing credential-handling protections.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill invokes a bundled shell script but does not declare any tool restrictions or allowed tool scope, so an agent/runtime may permit broader command execution than the skill actually needs. That increases the attack surface because shell-capable skills can be repurposed to run unintended commands, access local files, or chain with other tools if enforcement is weak.

External Transmission

Medium

• Category: Data Exfiltration

Content

Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**17 endpoints across 7 platform group(s).**

• Confidence: 83% confidence
• Finding: This skill is explicitly designed to transmit user-supplied queries and target URLs to an external third-party API at api.crawlora.net, which creates a real data egress boundary. In a competitor-intelligence context, prompts, company names, URLs, review targets, and other potentially sensitive business research inputs may be sent off-platform without clear user consent or data-classification guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This markdown file instructs callers to use an `x-api-key` header populated from `$CRAWLORA_API_KEY`, which involves credential use and network transmission. While the endpoint reference is technical, it does not include any warning about protecting the key or that requests send user-provided queries and URLs to an external service.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The Bing search endpoint description states that locale defaults to `country=us` and `lang=en-us`, which can bias results toward a specific locale. The file does not pair this with any user-choice guidance or explain that callers should explicitly select locale when appropriate.

Static analysis

No suspicious patterns detected.