Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed deal-research helper that queries Crawlora for Slickdeals and RetailMeNot data, with no evidence of hidden persistence, account mutation, or unrelated data access.
Install only if you are comfortable using Crawlora as the deal-search provider. Treat search terms, merchant domains, and deal URLs as data sent to Crawlora, and avoid putting secrets or private account information into queries.
The skill explicitly instructs use of a shell script but does not declare any tool scope, permissions, or allowed-tools boundary. That creates an authorization gap where an agent may invoke shell capability more broadly than intended, increasing the chance of unintended command execution or access beyond the minimal need for this research workflow.
The file explicitly directs the workflow to send requests to an external third-party service at api.crawlora.net using an API key. In skill context, this creates a real external-transmission surface: user-supplied search terms, store domains, URLs, and related query data may be sent off-platform without an explicit trust boundary or consent warning.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**24 endpoints across 2 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file documents calls to an external API and explicitly requires the x-api-key: $CRAWLORA_API_KEY header, which indicates network transmission and use of a credential. The reference does not include any warning about sending data to a third-party service or handling the API key, so users may not be alerted to the privacy and credential-use implications.
No suspicious patterns detected.