developer-oss-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:46 PM UTC
• Version: 1.0.15

Overview

The skill is mostly a disclosed Crawlora API research helper, but its shell wrapper is broader than its documented read-only endpoint catalog.

Install only if you are comfortable sending public research queries and identifiers to Crawlora with your own API key. Review or constrain scripts/crawlora.sh before use in shared or automated environments, especially to reject POST and enforce exact documented paths.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:46
• Finding: Overly Broad Route and HTTP Method Allowlisting Permits Undocumented Authenticated API Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 46–88 **Vulnerability Type**: Improper input validation and ineffective API route allowlisting **Risk Level**: Medium ### Vulnerable Code ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the developer-oss-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the developer-oss-research skill" >&2 exit 2 ;; esac case "$path" in /chromewebstore/categories) ;; /chromewebstore/category) ;; /chromewebstore/charts) ;; /chromewebstore/collection) ;; /chromewebstore/developer) ;; /chromewebstore/item) ;; /chromewebstore/permissions) ;; /chromewebstore/privacy) ;; /chromewebstore/reviews) ;; /chromewebstore/search) ;; /chromewebstore/similar) ;; /chromewebstore/suggest) ;; /github/org/*) ;; /github/org/*/repos) ;; /github/repo/*/*) ;; /github/repo/*/*/contributors) ;; /github/repo/*/*/forks) ;; /github/repo/*/*/languages) ;; /github/repo/*/*/releases) ;; /github/search/repositories) ;; /github/search/users) ;; /github/trending) ;; /github/trending/developers) ;; /github/user/*) ;; /github/user/*/events) ;; /github/user/*/followers) ;; /github/user/*/following) ;; /github/user/*/pinned) ;; /github/user/*/repos) ;; *) echo "path is not in the developer-oss-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis Bash `case` patterns use shell glob semantics, where `*` can match slash characters as well as ordinary characters. Consequently, ostensibly narrow patterns such as: ```bash /github/user/* /github/org/* /github/repo/*/* ``` do not enforce the expected number of path segments. For example, they can accept paths such as: ```text /github/user/alice/undocumented/action /github/org/example/undocumented/action /github/ ...[truncated 2653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Enforce exact path shapes.** Validate dynamic segments separately and ensure they cannot contain `/`. For example, restrict GitHub owner, repository, organization, and username segments to the character set accepted by the upstream service. 2. **Use anchored regular expressions instead of broad shell globs.** Example: ```bash if [[ "$path" =~ ^/github/user/[A-Za-z0-9-]+$ ]]; then : elif [[ "$path" =~ ^/github/user/[A-Za-z0-9-]+/(events|followers|following|pinned|repos)$ ]]; then : elif [[ "$path" =~ ^/github/org/[A-Za-z0-9-]+$ ]]; then : elif [[ "$path" =~ ^/github/org/[A-Za-z0-9-]+/repos$ ]]; then : elif [[ "$path" =~ ^/github/repo/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then : elif [[ "$path" =~ ^/github/repo/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/(contributors|forks|languages|releases)$ ]]; then : else echo "path is not in the developer-oss-research skill catalog" >&2 exit 2 fi ``` 3. **Bind HTTP methods to individual endpoints.** Since the current endpoint reference documents only GET operations, reject POST entirely unless a specific POST endpoint is later introduced: ```bash [ "$method" = "GET" ] || { echo "only GET is supported by this skill catalog" >&2 exit 2 } ``` 4. **Prefer a structured endpoint table.** Store each route pattern together with its allowed method rather than validating the method and route independently. 5. **Add negative security tests** covering: - Additional path segments after usernames, organizations, and repositories. - Empty dynamic path segments. - POST requests to every GET-only endpoint. - Encoded separators and traversal-like syntax. - Valid documented routes to prevent regressions. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill instructs use of a shell helper (`scripts/crawlora.sh`) but does not declare any tool scope such as `permissions` or `allowed-tools`. That creates a governance gap: an agent may execute shell commands without explicit constraint, increasing the chance of unintended command execution or overly broad system access in environments that rely on manifest-declared permissions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file explicitly documents that requests are sent to a third-party API using an API key, but it does not warn that user-supplied queries, identifiers, and other parameters will leave the local environment. In a research skill, users may provide sensitive repository names, usernames, org names, or extension identifiers; undisclosed third-party transmission creates a privacy and data-handling risk even if the calls are expected for functionality.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**29 endpoints across 2 platform group(s).**

• Confidence: 91% confidence
• Finding: The endpoint reference instructs the skill to communicate with an external service at api.crawlora.net and to include an API key, which confirms outbound data transmission to a third party. In this skill context, external calls are core functionality, but the risk remains because user queries and metadata are exposed to an external provider and may be logged, retained, or analyzed outside the primary system's controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: Multiple endpoint descriptions specify `lang=en` as a default, which implicitly forces an English locale when users do not choose one. Under the locale-policy rule, this is a natural-language policy issue because the file does not offer user choice or explain why English is required.

Static analysis

No suspicious patterns detected.