Security audit
Security checks for vulnerabilities and agentic risk
This skill provides read-only entertainment research through a disclosed service, with a few extra public-data lookups beyond movies and TV.
Use a dedicated Crawlora key and keep queries free of private information: the service receives them, and calls may consume credits. The reference also includes game research and public Letterboxd profile statistics. The supplied files show no material security concern; the remote service itself was not audited.
The declared scope is movies and television, but the executable route allowlist explicitly enables video-game research. These routes are an undeclared capability, even though they use the same API provider. The API-key handling, temporary curl configuration, and GET request implementation are supporting details and do not independently constitute mismatches.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Get a free Crawlora API key (2,000 credits/mo, no card) at [<redacted-url>).
- Set `CRAWLORA_API_KEY` in the environment before running the helper.
- The helper reads `CRAWLORA_API_KEY` from the environment and sends requests to `https://api.crawlora.net/api/v1`. Missing/invalid key → `401`.
## How it works
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**128 endpoints across 7 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
esac
# Fixed, non-overridable: an env-configurable base URL would let anything that
# can set CRAWLORA_API_BASE redirect this key to an attacker-controlled host.
base="https://api.crawlora.net/api/v1"
method="GET"
args=()
This endpoint accepts an arbitrary username and retrieves account-level statistics, including films watched, lists, and follower/following counts. Although the information is public, researching audience accounts is distinct from retrieving a title's metadata, cast, ratings, reviews, streaming offers, or box-office performance.
The file identifies these as endpoints the skill uses (L005), including dedicated Metacritic game-detail, game critic-review, and game user-review endpoints. Researching video games is a distinct capability not justified by the manifest's movie and TV scope; naming Metacritic as a source does not declare support for all its content categories.
L177–L179 explicitly allow Metacritic game metadata, critic-review, and user-review routes, which the helper can request using the Crawlora API key. Video-game research is not justified by the manifest's stated movie and TV research purpose.