Security audit
Security checks for vulnerabilities and agentic risk
The skill is a clearly scoped Kohl's research helper that sends user-requested retail queries to the documented Crawlora API, with no evidence of hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable using Crawlora as a third-party API for Kohl's research. Use city or ZIP for store lookup when possible rather than a full home or work address, and keep CRAWLORA_API_KEY in the environment only, as the skill recommends.
The skill explicitly instructs use of a shell helper script (scripts/crawlora.sh) but does not declare any tool restrictions or allowed-tool scope. That mismatch increases the risk that an agent can invoke broader shell capabilities than intended, which can enable command execution beyond the narrow API-calling purpose of the skill.
The skill explicitly supports sending free-text location data, including addresses, to an external API without any documented privacy warning, minimization guidance, or consent expectation. In the context of a retail store locator, users may provide precise home or work addresses, creating unnecessary exposure of sensitive location data to a third-party service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints are used by the skill and should be called via a script, but it does not define any explicit trigger phrases, scope limits, or exclusion conditions for when a user request should invoke this skill content. In a skill reference context, that ambiguity can contribute to unintended activation because the usage boundary is left implicit.
No suspicious patterns detected.