Security audit
Security checks for vulnerabilities and agentic risk
This skill uses a disclosed Crawlora API helper to gather public review data for feedback analysis, with no evidence of hidden persistence, privilege escalation, or unrelated data access.
Before installing, be comfortable sending your Crawlora API key and query terms to Crawlora. Use bounded samples, choose the relevant market/language explicitly, avoid collecting unnecessary author details, and treat public review samples as directional evidence rather than full population statistics.
The skill explicitly instructs the user to run a bundled shell script, but the manifest does not declare any tool restrictions or allowed-tools scope. That creates an avoidable trust gap: an agent or user may execute shell-capable behavior without clear least-privilege boundaries, increasing the risk of unintended command execution or future script abuse if the bundled script changes.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The Google Play endpoint descriptions state defaults of lang=en and country=us, which imposes a specific language/locale choice in natural-language documentation. This can violate locale-choice policy because the file does not indicate user opt-in or justify why English/US defaults are required.
The Adidas endpoint descriptions explicitly say the locale defaults to en_US and that topic labels remain English regardless of locale. This is a natural-language locale policy concern because it bakes in English behavior without offering user choice or documenting a justified regional constraint.
No suspicious patterns detected.