music-podcast-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:44 PM UTC
• Version: 1.0.16

Overview

The skill mostly matches its music and podcast lookup purpose, but its helper can send authenticated POST requests and loosely matched paths beyond the documented read-only endpoint list.

Install only if you are comfortable sending music and podcast lookup inputs to Crawlora with your Crawlora API key. Keep the key scoped and private, monitor credit use, and avoid using POST or undocumented nested paths unless the publisher documents and justifies those operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:51
• Finding: Overly Permissive HTTP Method and Route Allowlist## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 51–154 **Vulnerability Type**: Insufficient request method and path validation **Risk Level**: Medium The helper attaches the user's Crawlora API key to requests after validating them against a route allowlist. However, it permits both `GET` and `POST` for every accepted route even though the endpoint reference documents the skill's 58 endpoints as `GET` operations. Several parameterized route patterns also use shell wildcards that can match `/` characters and therefore accept undocumented nested paths. Relevant code: ```sh case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the music-podcast-research skill" >&2 exit 2 ;; esac ``` ```sh case "$path" in /apple-podcasts/charts) ;; /apple-podcasts/charts/rankings) ;; /apple-podcasts/episodes/search) ;; /apple-podcasts/new) ;; /apple-podcasts/search) ;; /apple-podcasts/show/*) ;; /apple-podcasts/show/*/episodes) ;; /apple-podcasts/show/*/related) ;; /discogs/artist/*) ;; /discogs/artist/*/releases) ;; /discogs/label/*) ;; /discogs/label/*/releases) ;; /discogs/master/*) ;; /discogs/release/*) ;; /discogs/search) ;; # Additional fixed routes omitted for brevity. *) echo "path is not in the music-podcast-research skill catalog" >&2 exit 2 ;; esac ``` ```sh else [ -n "$body" ] || body="${rest[0]:-}" [ -n "$body" ] || body='{}' # Stream the body on stdin so curl never interprets a user value as its # @file shorthand (and cannot read local files supplied in a request body). printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" --data-binary @- "${base}${path}" fi ``` ### Technical Analysis Bash `case` patterns use glob semantics. A pattern such as `/discogs/artist/*` does not constrain `*` to a single path ...[truncated 2150 chars]
• Remediation: ## Remediation Suggestions 1. Reject `POST` by default and permit only the method documented for each route. For the current endpoint catalog, restrict the helper to `GET`. 2. Replace broad shell wildcard checks with exact, anchored route validation. 3. For parameterized routes, require exactly one non-empty segment and reject embedded slashes. For example, validate an artist route against an equivalent of `^/discogs/artist/[^/]+$`. 4. Maintain a method-and-route table so authorization is performed on the tuple of HTTP method and normalized path rather than through independent checks. 5. Validate path parameter formats where known, such as numeric Discogs and Apple Podcasts identifiers. 6. Add negative tests covering nested suffixes, unsupported methods, empty identifiers, duplicate slashes, traversal syntax, query fragments, and undocumented routes. 7. Keep the existing fixed API origin, private temporary curl configuration, API-key character validation, and local-file upload protections, as these appropriately reduce credential and file-disclosure risks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of a shell helper script but does not declare any explicit tool scope or allowed-tools boundary. That creates an avoidable permission gap: an agent may infer broader shell access than necessary, increasing the risk of unintended command execution or misuse if future edits introduce unsafe inputs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file instructs users to call external endpoints via a script and states that requests require the `x-api-key: $CRAWLORA_API_KEY` header. It does not include any user-facing warning that queries, URLs, or identifiers supplied to the skill will be transmitted to a third-party service, nor any caution about handling the required credential.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.