crawlora

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 1:30 PM UTC
• Version: 1.0.20

Overview

The skill is a disclosed wrapper for Crawlora's public web data API and its sensitive behavior is limited to sending requested public-data queries and the Crawlora API key to that service.

Install only if you intend to use Crawlora as a third-party provider for public web data. Keep the API key scoped to Crawlora, do not include secrets or private conversation context in queries, and be careful with precise addresses or coordinates because those parameters are sent to Crawlora when used.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Ae1

High

• Category: analysis-evasion

Content

you the endpoints in the bundled [catalog](reference/catalog.md) — search engines,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

you the endpoints in the bundled [catalog](reference/catalog.md) — search engines,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

you the endpoints in the bundled [catalog](reference/catalog.md) — search engines,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae5

High

• Category: analysis-evasion
• Confidence: 100% confidence
• Finding: Instruction-capable artifact exceeds whole-file semantic analysis limits

Credential Access

High

• Category: Privilege Escalation

Content

### `sephora_stores`

- **HTTP:** `GET /sephora/stores`
- **What:** Sephora store locator. Returns Sephora physical store locations near a coordinate (address, hours, BOPIS/curbside/same-day flags). Renders through a JS-executing browser backend, unlike every other Sephora endpoint -- the store-locator data call itself is plain HTTP, but it requires a per-visit access token minted by an endpoint gated behind a bot-management JS challenge, so responses may take longer.
- **Params:** `latitude` (number, **required**) — Latitude, -90 to 90; `limit` (integer, optional) — Max stores to return, 1 to 50, defaults to 10; `longitude` (number, **required**) — Longitude, -180 to 180; `radius` (integer, optional) — Search radius in miles, 1 to 500, defaults to 50

### `sephora_suggest`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill explicitly instructs use of a shell helper script and outbound API calls, but it declares no tool restrictions such as allowed-tools or permissions. In an agent environment, that omission can let the skill be invoked with broader-than-necessary execution capability, increasing the chance of unintended shell use, command composition with user-controlled input, or data exfiltration through arbitrary commands.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation guidance is extremely broad ('use whenever the user needs real data from a public website'), which can cause the agent to select this skill for many unrelated requests. That over-selection raises security risk because a shell-capable, networked skill may be used in contexts where a narrower, safer skill or no external call would be more appropriate, potentially sending unnecessary user queries or sensitive context to the third-party API.

External Transmission

Medium

• Category: Data Exfiltration

Content

Set `CRAWLORA_API_KEY` to the key you received before running the helper.

- All requests go to `https://api.crawlora.net/api/v1` with the header
  `CRAWLORA_API_KEY` from the environment. A missing/invalid key returns `401`.

## How it works

• Confidence: 91% confidence
• Finding: The skill is designed to transmit prompts and query parameters to an external service at api.crawlora.net using an API key from the environment. External transmission is expected for this skill, but it remains a real security concern because agent/user-supplied data may be sent off-platform, and the broad catalog increases the chance of over-sharing request content or metadata.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file instructs callers to send `x-api-key: $CRAWLORA_API_KEY`, which involves accessing and transmitting a credential. Under the markdown-file warning rule, the description should clearly warn users that the skill requires a secret API key and that requests will send it to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The file broadly directs users to select endpoints from a large public-web-data API surface, and many listed endpoints accept precise addresses, ZIP/postal codes, or latitude/longitude. The markdown does not include any upfront warning that using these endpoints may transmit user location data to an external provider.

Static analysis

No suspicious patterns detected.