gaming-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:48 PM UTC
• Version: 1.0.15

Overview

The skill mainly performs game lookups, but its helper can use the Crawlora API key for routes and request bodies broader than the main Steam and PlayStation description.

Review before installing. Use it only if you are comfortable giving a Crawlora API key to this helper, restrict use to the game endpoints you intend, avoid sending private text in POST bodies, and monitor Crawlora credit usage. The artifact does not show persistence, destructive behavior, or credential theft, but its route and method surface should be narrowed or more clearly disclosed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/crawlora.sh:68
• Finding: Undocumented Roblox API Routes Exceed the Declared Skill Scope## Vulnerability Details **File Location**: `scripts/crawlora.sh:68-71`; `reference/endpoints.md:189-213` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Low ### Vulnerable Code ```sh /roblox/badges) ;; /roblox/game) ;; /roblox/rankings) ;; /roblox/search) ;; ``` The corresponding endpoint documentation exposes all four routes: ```md ## Roblox (4) ### `roblox_badges` - **HTTP:** `GET /roblox/badges` ### `roblox_game` - **HTTP:** `GET /roblox/game` ### `roblox_rankings` - **HTTP:** `GET /roblox/rankings` ### `roblox_search` - **HTTP:** `GET /roblox/search` ``` ### Technical Analysis `SKILL.md` declares that the Skill researches games through Steam and the PlayStation Store. It does not declare Roblox support. Nevertheless, the executable route allowlist permits four Roblox endpoints, and the endpoint reference advertises them. These endpoints reportedly return public catalog information and do not expose Roblox account, purchase, or server data. The issue is therefore not direct account compromise. However, the routes expand the authenticated API surface beyond the minimum privileges necessary for the Skill's declared functionality. Because the helper attaches the user's Crawlora API key to these requests, an agent can consume the user's API quota for an undeclared platform. The fixed API host and explicit route allowlist limit the exposure. ### Attack Path 1. A user installs or loads the Skill based on its declared Steam and PlayStation functionality. 2. An untrusted instruction or agent action invokes `scripts/crawlora.sh` with one of the undocumented `/roblox/*` paths. 3. The path passes the helper's route allowlist. 4. The helper attaches the user's `CRAWLORA_API_KEY`. 5. The authenticated request reaches Crawlora and may consume the user's API credits for functionality outside the declared scope. ### Impact Assessment The obtain ...[truncated 484 chars]
• Remediation: ## Remediation Suggestions 1. Remove the four `/roblox/*` entries from the route allowlist if Roblox is not required. 2. Remove the Roblox section from `reference/endpoints.md`. 3. Generate the executable allowlist from a single reviewed manifest to prevent documentation and implementation from drifting. 4. Add an automated test that compares routes allowed by the helper with platforms explicitly declared in `SKILL.md`. 5. If Roblox support is intentional, explicitly disclose it in the Skill name, description, usage criteria, examples, and security documentation. 6. Retain only the Roblox endpoints strictly necessary for the newly declared purpose.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/crawlora.sh:31
• Finding: Unnecessary Generic POST Body Transmission Creates a Sensitive-Data Egress Channel## Vulnerability Details **File Location**: `scripts/crawlora.sh:31-49, 125-129` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Low ### Vulnerable Code ```sh method="GET" body="" args=() while [ $# -gt 0 ]; do case "$1" in -X) method="$2"; shift 2 ;; -d) body="$2"; shift 2 ;; *) args+=("$1"); shift ;; esac done [ "${#args[@]}" -ge 1 ] || { echo "usage: crawlora.sh [-X METHOD] /path [k=v ... | json-body]" >&2; exit 2; } path="${args[0]}" rest=("${args[@]:1}") case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the gaming-research skill" >&2 exit 2 ;; esac ``` ```sh else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` The helper also advertises unrelated POST examples: ```sh # POST : crawlora.sh -X POST /google/search '{"keyword":"web scraping api","language":"en","country":"us"}' # POST : crawlora.sh -X POST /google/trends/explore/interest-over-time '{"keywords":["bitcoin"]}' ``` ### Technical Analysis All gaming endpoints documented in `reference/endpoints.md` use GET. Despite this, the helper accepts POST and forwards an arbitrary caller-supplied body to the fixed Crawlora API host. The implementation includes meaningful protections: it does not autonomously collect local files, streams the body through standard input to prevent curl's `@file` expansion, restricts routes through an allowlist, validates the API key, and fixes the destination to HTTPS on `api.crawlora.net`. Consequently, this is not evidence of intentional credential theft. Nevert ...[truncated 1829 chars]
• Remediation: ## Remediation Suggestions 1. Remove `-X`, `-d`, body parsing, and the POST execution branch because every documented endpoint uses GET. 2. Hardcode the request method to GET. 3. If future endpoints require POST, implement a per-route method allowlist rather than globally permitting POST. 4. Validate POST bodies against strict per-endpoint schemas, including permitted fields, types, and size limits. 5. Reject fields likely to contain credentials or unrelated sensitive data. 6. Remove the unrelated Google POST examples from the gaming helper. 7. Add tests confirming that POST requests fail for every GET-only route. 8. Preserve the existing fixed HTTPS destination, API-key validation, private temporary configuration, route allowlist, and protection against curl local-file expansion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior is narrower than the detected route surface, which includes undeclared Roblox access and additional Steam endpoints. When a skill exposes materially broader capabilities than its description, users and orchestrators may authorize it under false assumptions, enabling unexpected data access or actions outside the declared gaming-research scope.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises shell-based usage (`scripts/crawlora.sh`) but does not declare an explicit tool scope such as `allowed-tools` or permissions. That mismatch can cause an agent runtime to grant broader execution capability than users expect, increasing the risk of unintended command execution or use of shell beyond the narrowly described research task.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest limits the skill's purpose to researching games via Crawlora for Steam and PlayStation Store data. This file documents an additional Roblox platform group with four Roblox endpoints, indicating the skill supports a broader set of game-research capabilities than the manifest describes.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest says the skill researches video games via Crawlora specifically for Steam and PlayStation Store data. The code's allowed route catalog also permits /roblox/badges, /roblox/game, /roblox/rankings, and /roblox/search, which expands the skill beyond the described platforms and behavior.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The file hard-codes use of a single external API base, and throughout the document language/region behavior is presented as provider-controlled parameters rather than a user-selected locale policy. While this is an endpoint reference, it still natural-language-documents a fixed service context without stating any user opt-in or choice for locale handling.

Static analysis

No suspicious patterns detected.