opensea-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 12:54 PM UTC
• Version: 1.0.8

Overview

This skill is purpose-aligned for OpenSea research, but its helper can send authenticated requests to broader Crawlora paths and methods than the documented endpoint catalog describes.

Review before installing if you will use a real Crawlora API key or query wallet/profile identifiers. The skill does not appear malicious, but its helper should be tightened to exact route shapes and documented HTTP methods before use in sensitive or untrusted-agent workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crawlora.sh:43
• Finding: Route Allowlist and HTTP Method Restrictions Can Be Bypassed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 43–101 **Vulnerability Type**: Overly broad shell wildcard authorization and missing per-route method enforcement **Risk Level**: Medium ### Vulnerable Code ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the opensea-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the opensea-research skill" >&2 exit 2 ;; esac case "$path" in /opensea/activity) ;; /opensea/categories) ;; /opensea/chains) ;; /opensea/collection/*) ;; /opensea/collection/*/activity) ;; /opensea/collection/*/best-deals) ;; /opensea/collection/*/chart) ;; /opensea/collection/*/depth) ;; /opensea/collection/*/holders) ;; /opensea/collection/*/items) ;; /opensea/collection/*/offers) ;; /opensea/collection/*/rarest-items) ;; /opensea/collection/*/search-items) ;; /opensea/collection/*/social-proof) ;; /opensea/collection/*/top-sales) ;; /opensea/collection/*/trait-offers) ;; /opensea/collection/*/traits) ;; /opensea/collections) ;; /opensea/drops) ;; /opensea/item/*/*/*) ;; /opensea/item/*/*/*/activity) ;; /opensea/item/*/*/*/chart) ;; /opensea/item/*/*/*/depth) ;; /opensea/item/*/*/*/listings) ;; /opensea/item/*/*/*/offers) ;; /opensea/item/*/*/*/owners) ;; /opensea/most-watched) ;; /opensea/profile/*) ;; /opensea/profile/*/activity) ;; /opensea/profile/*/collections) ;; /opensea/profile/*/created) ;; /opensea/profile/*/items) ;; /opensea/profile/*/search-items) ;; /opensea/rankings) ;; /opensea/search/collections) ;; /opensea/top-movers) ;; *) echo "path is not in the opensea-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis Bash `case` patterns use glob matching, and `*` can match slash characters. Consequently, ostensib ...[truncated 2743 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace broad shell-glob authorization with explicit route parsing that validates the exact number of path segments. 2. Restrict every dynamic segment to an appropriate allowlist, such as collection slugs, chain identifiers, hexadecimal contract addresses, token IDs, and profile identifiers. 3. Bind each endpoint to its documented HTTP method. If all current routes are GET-only, reject POST entirely. 4. Avoid generic patterns such as `/opensea/profile/*`. Match exact route shapes and reject any trailing segments. 5. Consider implementing route validation with anchored regular expressions or a table containing the allowed method and path pattern for each endpoint. 6. Add negative tests for nested paths, extra trailing segments, empty path parameters, encoded separators, unsupported methods, and undocumented endpoints. 7. Continue using the fixed HTTPS API origin and private temporary curl configuration, as these controls appropriately reduce API-key exposure. A hardened validation design should follow this structure: ```bash case "${method} ${path}" in "GET /opensea/activity"| "GET /opensea/categories"| "GET /opensea/chains"| "GET /opensea/collections"| "GET /opensea/drops"| "GET /opensea/most-watched"| "GET /opensea/rankings"| "GET /opensea/search/collections"| "GET /opensea/top-movers") ;; *) # Validate parameterized routes separately with anchored expressions and # exact segment counts before accepting them. ;; esac ``` Parameterized routes should then be checked using anchored expressions that cannot consume `/` inside a dynamic segment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes shell commands in its examples and operational flow but does not declare any explicit tool restrictions such as allowed-tools or permissions. In an agent environment, that broadens the execution surface and can let the model use shell more freely than intended, increasing the chance of command misuse, unsafe argument construction, or unexpected local access.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Get a Crawlora API key at [crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills).
- Set `CRAWLORA_API_KEY` in the environment before running the helper.
- The helper reads `CRAWLORA_API_KEY` from the environment and sends requests to `https://api.crawlora.net/api/v1`.

## How it works

• Confidence: 83% confidence
• Finding: The skill requires an API key in an environment variable and sends requests to an external third-party service, which creates a real data egress path outside the host environment. Even if the intended data is public OpenSea research, an agent with shell/network access could transmit user-supplied queries, metadata, or mishandled secrets to the external API, so the external transmission risk is genuine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly instructs the skill to send user-supplied query, path, and body parameters to an external third-party API using an API key, but it provides no user-facing warning or consent guidance about that data leaving the local agent context. In a research skill that may accept wallet addresses, ENS names, collection identifiers, or search terms, this creates a real privacy and data-governance risk because sensitive or user-specific inputs may be transmitted off-platform without transparency.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**36 endpoints across 1 platform group(s).**

• Confidence: 93% confidence
• Finding: The file hardcodes an external API base URL and instructs callers to invoke it with an API key, confirming that the skill depends on outbound network transmission to a third party. That is not inherently malicious, but in the absence of warning, scoping, or guardrails, any user-provided identifiers and search inputs handled by the skill can be sent externally, exposing potentially sensitive research activity or wallet-linked data.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.