Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora-backed lookup helper for public music and podcast data; it sends lookup terms and URLs to Crawlora but does not show hidden persistence or privilege escalation.
Install only if you are comfortable sending music and podcast lookup terms, public profile URLs, media URLs, and your Crawlora API key to Crawlora. Avoid using it for sensitive private searches or account identifiers.
The skill invokes a shell helper (scripts/crawlora.sh) but does not declare any explicit tool restrictions such as allowed-tools or permissions. That creates an unnecessary trust gap: an agent runtime may permit broader shell usage than intended, increasing the chance of command execution beyond simple API calls if the skill is extended or misused.
The endpoint reference hard-codes use of an external service at api.crawlora.net and describes sending path, query, and body parameters there under an API key. This means user inputs and requested resource identifiers are exfiltrated outside the local agent boundary, which is a genuine data exposure risk if users provide sensitive terms, URLs, or account identifiers.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**58 endpoints across 5 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The file explicitly instructs callers to send user-supplied identifiers and queries to an external API using an API key, but it does not disclose that these inputs will leave the local environment. In a research skill that may be used on arbitrary user requests, this creates a real privacy/transparency issue because search terms, profile URLs, and media identifiers are transmitted to a third-party service.
No suspicious patterns detected.