Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently supports creator discovery through a disclosed Crawlora API helper, with no evidence of hidden execution, persistence, or destructive behavior.
Install only if you are comfortable sending campaign queries and creator lookup parameters to Crawlora using your Crawlora API key. Treat CRAWLORA_API_KEY as a secret, request contact emails only for a legitimate outreach need, and avoid sharing raw outputs that include personal contact data unless appropriate.
The skill instructs use of a bundled shell script and external API but does not declare any tool scope or allowed-tools restrictions. That creates an over-broad execution surface: an agent may be permitted to run shell commands without explicit limitation, making accidental or unauthorized command execution more likely if the script or surrounding instructions are modified or abused.
The endpoint explicitly supports returning stored contact email addresses for creators, but the documentation gives no privacy, authorization, or data-minimization guidance. In a creator-discovery skill, this increases the chance that downstream agents will collect or expose personal contact data more broadly than necessary, especially if outputs are shared or logged.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file tells users to call the API with x-api-key: $CRAWLORA_API_KEY, which involves use of a sensitive credential. The reference does not include any caution about protecting the key, avoiding exposure in logs/shared commands, or treating it as secret material.
The endpoint description says hl and gl default to en and US, which imposes a specific language and locale context by default. The file does not frame this as a user choice or opt-in, so it may violate a language/locale neutrality policy.
No suspicious patterns detected.