Security audit
Security checks for vulnerabilities and agentic risk
This skill is a purpose-aligned Nike catalog lookup helper that uses a disclosed third-party API and does not show hidden persistence, privilege escalation, destructive behavior, or credential theft.
Before installing, be comfortable with using Crawlora as a third-party service for Nike lookups. Product searches and nearby-store coordinates are sent to Crawlora, and you should keep CRAWLORA_API_KEY private and avoid sharing logs that might expose it.
The skill instructs use of a shell helper (scripts/crawlora.sh) but does not declare any tool scope or allowed-tools constraints. That increases the chance an agent can invoke shell more broadly than necessary, expanding attack surface and enabling unintended command execution paths if the skill or downstream inputs are later modified or composed with other prompts.
The skill supports nearby-store lookups using precise latitude/longitude and sends that data to a third-party API, but it does not disclose this data sharing or prompt for appropriate user consent. Location data is sensitive personal information, and silent transmission to an external service can create privacy, compliance, and trust risks even if the API use is otherwise legitimate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The markdown explicitly instructs callers to supply x-api-key: $CRAWLORA_API_KEY, which involves use of a sensitive credential. The file does not include any warning or handling guidance about protecting that secret, avoiding accidental logging/sharing, or ensuring the user understands credential use.
No suspicious patterns detected.