Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Old Navy catalog lookup helper that sends user-requested product and location queries to Crawlora and does not show hidden persistence, mutation, or privilege behavior.
Install only if you are comfortable using Crawlora as a third-party service for Old Navy/Gap Inc. catalog lookups. Protect CRAWLORA_API_KEY, avoid sending sensitive location details unless needed for store availability, and expect searches, product ids, zip codes, or coordinates you request to be sent to Crawlora.
The skill invokes shell commands via scripts/crawlora.sh but does not declare any permissions or allowed-tools scope. That creates an under-specified trust boundary: an agent may be allowed to execute shell unexpectedly, increasing the chance of command execution beyond what a reviewer or runtime policy intended.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file states that all endpoints require the x-api-key: $CRAWLORA_API_KEY header and target an external API, but it provides no warning about using credentials or sending request data to a third-party service. Under the markdown-file criteria for missing user warnings, external-network behavior and credential use should be disclosed when they may affect privacy or system integrity.
No suspicious patterns detected.