Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed public GitHub developer-discovery helper with scoped API access and privacy guardrails, though users should handle returned public profile/contact data carefully.
Install only if you are comfortable sending scoped public GitHub search queries and your Crawlora API key to Crawlora. Use it for bounded, job-relevant evidence review, avoid using public contact fields for unsolicited outreach, and treat profile-derived location, availability, and activity signals as stale or incomplete unless separately verified.
The skill invokes shell capabilities via a bundled script but does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization and review gap: an agent or operator may permit broader execution than intended, making it easier for a modified or substituted script to run unexpected commands or exfiltrate data under the guise of normal skill operation.
The file documents access to public profile, activity, and contact-adjacent attributes such as email, Twitter, blog, and 'reachable' status without any privacy-use warning or minimization guidance. In a talent-discovery context, that increases the risk of profiling, over-collection, or downstream misuse of personal data even if the data is publicly exposed.
The manifest says the skill is for finding developers and verifying repository/contribution evidence for technical shortlists or collaborator discovery. This file documents github_search_repositories specifically as public repository search for "market/competitive discovery," which goes beyond developer-focused talent discovery and introduces a broader research use case not described in the manifest.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints are used by a workflow and should be called via a shell script, but it does not specify when this reference should or should not be used, nor any explicit trigger phrases or exclusions. For a markdown file, that makes activation scope ambiguous and could contribute to unintended use if consumed as a skill description.
No suspicious patterns detected.