Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora API helper for journalist research, with network and API-key use that fits its stated purpose.
Install only if you are comfortable sending research queries, public URLs, and your Crawlora API key to Crawlora. Avoid submitting private URLs or sensitive brief details unless your Crawlora account and data-use expectations allow it.
The skill invokes a shell script (scripts/crawlora.sh) but does not declare any tool restrictions or allowed-tools scope. That creates unnecessary execution ambiguity: an agent runtime may permit broader shell access than intended, increasing the chance of unintended command execution or misuse if the script or invocation path is modified.
This markdown file describes calling remote API endpoints and explicitly requires the x-api-key: $CRAWLORA_API_KEY header, but it does not include a user-facing warning about transmitting requests and authentication data to an external service. Under the markdown-specific warning criteria, externally visible network behavior and credential use should be disclosed when they could affect privacy or system integrity.
The web_scrape endpoint can fetch and process any public URL, which may transmit user-provided targets to a third-party service and interact with external sites. Although the text mentions respecting site terms and robots directives, it does not warn users about the privacy implications of sending URLs/content to the service or the external-network behavior itself.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
The Bing endpoint descriptions state that locale defaults to country=us and lang=en-us, which imposes a specific language/locale behavior by default. Because the documentation does not frame this as a user choice or justified region-specific requirement, it conflicts with the policy against forcing a locale without opt-in.