Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed GDELT news and TV research helper that sends user-chosen queries to Crawlora and does not show hidden persistence, privilege escalation, or unrelated data access.
Install only if you are comfortable sending your search terms, filters, and Crawlora API-key-authenticated requests to Crawlora. Do not put secrets, credentials, private identifiers, or highly sensitive investigative content in query parameters, and keep CRAWLORA_API_KEY in the environment rather than committing it.
The skill invokes a shell helper (scripts/crawlora.sh) but does not declare any tool restrictions or permissions. That mismatch weakens least-privilege controls and could let an agent execute shell-based actions beyond what a reviewer or runtime policy expects, especially if later edits add more shell behavior.
The document explicitly instructs callers to send requests, including user-supplied query parameters, to a third-party service using an API key, but it does not disclose the privacy and data-handling implications. In a research skill where user prompts may contain sensitive investigative topics, this omission can cause unintentional external transmission of user data without informed consent.
The skill is designed to send authenticated requests to an external API endpoint, which means user inputs and derived research parameters leave the local trust boundary. While external calls are expected for this skill's purpose, the security concern is real because there is no accompanying limitation or warning about sending sensitive content to the third party.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**12 endpoints across 1 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")