Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed public news/media research helper that sends bounded GET requests to Crawlora and does not show hidden persistence, privilege escalation, or destructive behavior.
Install only if you are comfortable sending requested public-news queries and article URLs to Crawlora under your Crawlora API key. Do not use it with secrets, private intranet URLs, unpublished documents, or sensitive investigative queries unless that data is appropriate for the third-party API.
The skill invokes a shell helper (scripts/crawlora.sh) but does not declare any explicit tool scope or permissions boundary. That creates an avoidable trust gap: an agent/runtime may permit broader shell usage than the skill actually needs, increasing the chance of unintended command execution or misuse if the helper or future edits become unsafe.
This skill is explicitly designed to transmit user-supplied queries and target URLs to an external third-party service, Crawlora. In a research skill, that external transmission can expose sensitive user interests, proprietary URLs, or internal context if callers pass non-public data, especially because the documentation gives no guardrails about what may be sent off-platform.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**990 endpoints across 205 platform group(s).**
The manifest describes a skill for researching public news articles and coverage, but this reference documents dedicated video endpoints such as ghanaweb_video, ghanaweb_video_sections, and ghanaweb_videos. Video catalog and metadata retrieval is a broader media capability than the manifest’s stated article/news research scope, and it is not called out in the manifest description.
The manifest mentions headlines, article text, search, live coverage, and archives, which fits text/news retrieval. This reference additionally exposes ndtv_latest_videos, ndtv_video, ndtv_video_categories, and ndtv_videos, which are separate video-discovery and video-metadata features not reflected in the manifest description.
The manifest frames the skill as researching public news through article content, search, live coverage, and archives. The documented skynews_video and skynews_videos endpoints add video-hub browsing and video metadata retrieval, which is a distinct capability not described in the manifest.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file documents that the skill requires an x-api-key header sourced from $CRAWLORA_API_KEY and makes requests to an external API. Under the markdown-file criteria, descriptions should warn users about behaviors that can affect privacy or system integrity, but the file provides operational details without any caution about credential use or sending request data to a third-party service.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
### `politico_headlines`
- **HTTP:** `GET /politico/headlines`
- **What:** Get Politico site-wide headlines. Returns the latest Politico stories across the whole site, not limited to one section. Takes no parameters. Each item has its title, URL, a short summary, publication time and author.
- **Params:** _none_
### `politico_topic`