Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent public-news research helper that calls a disclosed third-party API and does not show hidden persistence, privilege escalation, destructive behavior, or private-data access.
Install only if you are comfortable sending news queries, article URLs, and your Crawlora API key to Crawlora. Avoid putting secrets, private personal data, or confidential research topics in query parameters, and be aware that the skill can also retrieve public TV-news metadata and Yahoo reader comments, not just article headlines.
The skill invokes shell commands in its examples (scripts/crawlora.sh ...) but does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may execute shell access more broadly than intended, especially if user-controlled query values are later interpolated into commands or if reviewers cannot tell that code execution is required.
This skill is designed to transmit user-supplied queries and fetched URLs to api.crawlora.net, an external service. External transmission is expected for the skill's function, but it remains security-relevant because it can expose user research topics, sensitive prompts, or linked content to a third party if not clearly disclosed and constrained.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**32 endpoints across 5 platform group(s).**
The manifest says the skill builds news briefings from GDELT, BBC, CNN, The Guardian, and Yahoo News, suggesting recent news-source research. The endpoint reference shows extensive GDELT TV capabilities over US television captions, transcripts, OCR text, concept entities, and visual labels, which is a materially broader media-analysis surface than ordinary source-aware news briefings from the named outlets.
The manifest describes a skill for building source-aware news briefings from headlines, topic monitoring, source comparison, and coverage timelines with links, dates, and uncertainty preserved. The documented Yahoo endpoints include article comment and reply harvesting, which is a distinct user-generated-content collection capability not implied by that briefing/research description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The documentation instructs use of an external API key and remote service without any warning about credential handling, data disclosure, or safe transmission practices. In an agent setting, this can lead users or downstream tooling to send sensitive queries or mishandle secrets when invoking the external service.
No suspicious patterns detected.