Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed FotMob football research helper that calls Crawlora's API and does not show hidden persistence, destructive behavior, or unrelated data access.
Install only if you are comfortable providing a Crawlora API key and sending your football research queries to Crawlora's API. Expect English/en-US media/news behavior where documented, and prefer the named MCP tools when available; the shell helper is scoped to documented FotMob GET endpoints.
The skill explicitly instructs use of a bundled shell script (scripts/crawlora.sh) but declares no permissions or allowed-tools scope. That mismatch weakens least-privilege controls and can let an agent invoke shell unexpectedly, increasing the chance of arbitrary command execution paths or unreviewed networked actions in environments that honor metadata for tool restriction.
The natural-language description states that the endpoint returns the "global English latest-news feed," which hard-codes a language choice. The file does not indicate user opt-in, configurability, or a documented justification for restricting results to English.
The text says the request "uses FotMob's English United States variant," which is a locale-specific behavior stated as mandatory. There is no indication that users can choose another locale or that this constraint is justified as a region-specific tool behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
No suspicious patterns detected.