Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed earnings-research helper that sends bounded financial lookup requests to Crawlora and does not show hidden, persistent, destructive, or privilege-escalating behavior.
Install only if you are comfortable sending ticker/company queries, filing identifiers, and your Crawlora API key to Crawlora. Avoid using it for non-public or sensitive research topics unless that data sharing is acceptable in your environment.
The skill invokes shell commands via a bundled script but does not declare any explicit tool scope or allowed-tools boundary. That increases risk because an agent/runtime may permit broader command execution than intended, making it easier for this skill to be used in environments without least-privilege controls.
The skill explicitly directs use of an external service endpoint and transmission of request data plus an API credential to a third-party domain. In an agent-skill context, this creates a real data egress boundary: user-provided symbols, queries, filing identifiers, and potentially derived research context may be sent off-platform without an explicit warning or trust boundary notice.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**10 endpoints across 2 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file describes use of an external API and explicitly requires the x-api-key: $CRAWLORA_API_KEY header, which involves credential use and network transmission. Under the markdown-specific warning criterion, the reference omits any caution about external requests or careful handling of the API key.