Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward patent-research helper that sends user patent queries to the Crawlora API using a user-provided API key, with no hidden persistence or unrelated behavior found.
Install only if you are comfortable sending patent search terms, assignee or inventor names, patent identifiers, and related query parameters to Crawlora with your API key. Avoid using it for confidential invention concepts, unreleased R&D, or sensitive freedom-to-operate work unless Crawlora's data handling terms meet your needs.
The skill invokes shell commands (scripts/crawlora.sh ... | jq) but does not declare any permissions or allowed-tools scope. This creates an avoidable least-privilege gap: an agent runtime may permit broader shell usage than is necessary, increasing the blast radius if the skill is misused or if later edits introduce unsafe command construction.
This skill is designed around external transmission to https://api.crawlora.net/api/v1 and requires authentication via x-api-key, so any user-supplied search terms or patent identifiers will be sent off-box. In the context of patent research, those terms may reveal confidential R&D plans, freedom-to-operate concerns, or pre-filing invention concepts, making undisclosed external transmission materially risky.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**8 endpoints across 2 platform group(s).**
The file explicitly instructs callers to send requests to an external service using an API key, but provides no user-facing warning that prompts and query data will leave the local environment. In an agent setting, this can cause unintended exfiltration of sensitive research terms, proprietary invention details, or user-provided identifiers to a third-party API without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says endpoints are used via scripts/crawlora.sh but does not specify concrete activation phrases, boundaries, or exclusion conditions for invoking the skill. In a skill-facing reference, that absence can make invocation conditions overly broad or unclear, increasing the chance of unintended use.