Security audit
Security checks for vulnerabilities and agentic risk
The skill provides scoped public entertainment research through Crawlora, with a minor discrepancy between its description and supported content.
Crawlora receives your research queries and API key, and requests may consume API credits. Use a dedicated key and avoid private information in searches. The endpoint catalog also supports public video-game research despite the narrower description. Review covered the bundled files; Crawlora's server-side behavior was not tested.
The declared scope is movies and TV, whereas the code explicitly authorizes video-game endpoints, creating a concrete scope mismatch. Otherwise, its fixed Crawlora API destination, API-key authentication, query handling, and temporary credential configuration support the declared functionality rather than constituting unrelated capabilities.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**99 endpoints across 5 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
esac
# Fixed, non-overridable: an env-configurable base URL would let anything that
# can set CRAWLORA_API_BASE redirect this key to an attacker-controlled host.
base="https://api.crawlora.net/api/v1"
method="GET"
args=()
L561–L577 list dedicated capabilities for retrieving video-game metadata, critic reviews, and user reviews. The reference identifies these as endpoints the skill uses (L005), but standalone video-game research is outside the manifest's movie-and-TV purpose and is not a necessary implementation detail of that purpose. This file documents the capability; it does not establish that these endpoints are actually invoked.
L148–L150 explicitly allow Metacritic game details, critic reviews, and user reviews. These routes are accepted for API requests, providing a video-game research capability that is not justified by the manifest's stated purpose of researching movies and TV titles.