Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora/Substack research helper that uses a user-provided API key and bounded public-data queries, with no evidence of hidden persistence, privilege escalation, or destructive behavior.
Before installing, confirm you are comfortable using Crawlora and sending newsletter search terms, publication identifiers, and your Crawlora API key to its API. Keep the API key protected, use narrow topic and date scopes, and review outputs as samples of public Substack data rather than complete market or audience measurements.
The skill invokes a shell script (scripts/crawlora.sh) but does not declare any explicit tool scope or allowed-tools boundary. That creates an avoidable privilege gap: an agent/runtime may permit broader shell execution than is necessary, increasing the chance of command misuse, prompt-influenced execution, or unintended local side effects.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints are used by a workflow and should be called via a shell script, but it does not define specific trigger phrases, scope constraints, or negative examples for when the skill should activate. In a skill context, that ambiguity can contribute to overly broad invocation because readers are not told what user requests are in or out of scope.
The markdown instructs callers to send requests to an external API using the x-api-key header populated from CRAWLORA_API_KEY. For markdown files, network behavior and credential use should be accompanied by a clear warning about external transmission and secret handling when those behaviors could affect privacy or system integrity.
No suspicious patterns detected.