Security audit
Security checks for vulnerabilities and agentic risk
This skill is a scoped Google Finance research helper that clearly uses Crawlora for read-only market lookups and does not show hidden persistence, account access, trading, or destructive behavior.
Install only if you are comfortable sending Google Finance lookup terms and instrument identifiers to Crawlora using your Crawlora API key. Do not include secrets, private portfolio details, or confidential business context in queries unless you intend to share them with that service.
The skill explicitly instructs use of a bundled shell script but does not declare any tool scope restrictions such as allowed-tools or permissions. That creates an avoidable trust gap: an agent may execute shell-capable actions without an explicit least-privilege contract, increasing the chance of unintended command execution or capability expansion.
This skill is designed to transmit user-supplied queries and identifiers to an external API endpoint at api.crawlora.net. While external access is expected for a finance lookup skill, the documentation does not prominently disclose the privacy and trust implications, so an agent may forward sensitive queries, internal context, or identifiers to a third party without adequate user awareness.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**20 endpoints across 1 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The file instructs callers to use an API key for requests to an external service but provides no warning about credential handling, third-party transmission, or minimizing sensitive data in requests. In a skill ecosystem, this omission can lead users or downstream agents to send secrets or sensitive prompts to Crawlora without informed consent or proper safeguards.
No suspicious patterns detected.