Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed housing-market research helper that calls a specific external API and does not show hidden persistence, destructive behavior, or credential theft.
Install only if you are comfortable sending housing-market search locations and filters to Crawlora using your Crawlora API key. Keep the API key in the environment, do not paste it into chats or reports, and avoid including sensitive personal financial details unless explicitly needed.
The skill instructs use of a bundled shell script but does not declare any tool scope or allowed-tools boundaries. That creates an avoidable trust gap: an agent may invoke shell capabilities more broadly than intended, and reviewers cannot easily verify the minimum required execution surface.
This file documents transmission to an external domain, which is expected for a data-retrieval skill, but it becomes a real security concern because no safeguards or data-sharing constraints are described. In a skill that may process user-supplied locations or related context, silent third-party transmission increases privacy and compliance risk even if the destination is legitimate.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**5 endpoints across 2 platform group(s).**
The file instructs use of an external API with an API key but provides no warning about credential sensitivity, external transmission, or user-consent boundaries. In an agentic context, this can lead to unintended sending of user-provided data to a third party or mishandling of secrets, especially if operators assume endpoint documentation is inherently safe.
The manifest describes a skill for comparing housing markets using historical dataset metrics such as prices, inventory, sales activity, time on market, and affordability trends. The documented redfin_search endpoint instead exposes public property listing search functionality, which is oriented toward browsing listings rather than comparing market-level housing statistics.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The file says these are the endpoints used by 'this workflow' and to call them via a script, but it does not define the workflow scope, activation conditions, or any exclusions. In a markdown reference file, this kind of underspecified usage guidance can make it unclear when the skill should be invoked versus when it should not.