Security audit
Security checks for vulnerabilities and agentic risk
This skill is a scoped podcast research helper that queries Crawlora for public Apple Podcasts and Spotify metadata, with no evidence of hidden persistence, destructive actions, or unrelated data access.
Install only if you are comfortable using Crawlora as a third-party API for podcast research. Keep CRAWLORA_API_KEY private and avoid sending confidential names, internal project terms, or sensitive investigation targets as search queries.
The skill includes shell command examples (scripts/crawlora.sh ...) but does not declare any permissions or allowed-tools scope. That mismatch can cause an agent runtime or reviewer to underestimate the skill's execution capabilities, increasing the chance that shell access is granted implicitly or used without clear policy controls.
The skill documentation explicitly routes user-supplied search terms, identifiers, and other parameters to an external service but does not warn that these values leave the local environment. In a research skill, queries may contain sensitive interests, names, or internal investigation targets, so silent network disclosure creates a real privacy and data-handling risk.
This file hard-documents use of the external endpoint https://api.crawlora.net/api/v1, meaning skill inputs and looked-up identifiers are transmitted off-platform to a third party. External transmission is expected for this skill's function, but it still represents a genuine security/privacy concern because podcast research queries can reveal user intent, subjects of investigation, or other sensitive metadata.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**16 endpoints across 2 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints should be called via scripts/crawlora.sh, but it does not define when or under what exact user requests that behavior should occur. In a skill reference context, the lack of explicit trigger boundaries or exclusions can contribute to overly broad invocation behavior.