product-price-research

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 1:12 PM UTC
• Version: 1.0.16

Overview

This skill is a disclosed Crawlora API helper for public product, price, availability, review, and store research, with no evidence of hidden persistence, local credential theft, or destructive behavior.

Install only if you are comfortable sending product searches, product identifiers, ZIP codes, coordinates, and similar lookup parameters to Crawlora. Keep CRAWLORA_API_KEY in the environment, do not paste secrets into prompts or request bodies, and avoid using this skill with sensitive personal, financial, health, or account data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

### `sephora_stores`

- **HTTP:** `GET /sephora/stores`
- **What:** Sephora store locator. Returns Sephora physical store locations near a coordinate (address, hours, BOPIS/curbside/same-day flags). Renders through a JS-executing browser backend, unlike every other Sephora endpoint -- the store-locator data call itself is plain HTTP, but it requires a per-visit access token minted by an endpoint gated behind a bot-management JS challenge, so responses may take longer.
- **Params:** `latitude` (number, **required**) — Latitude, -90 to 90; `limit` (integer, optional) — Max stores to return, 1 to 50, defaults to 10; `longitude` (number, **required**) — Longitude, -180 to 180; `radius` (integer, optional) — Search radius in miles, 1 to 500, defaults to 50

### `sephora_suggest`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of a shell helper (`scripts/crawlora.sh`) but does not declare any tool scope such as `allowed-tools` or `permissions`. That mismatch can allow broader-than-intended command execution in hosts that rely on manifest-level restrictions, increasing the chance of command misuse or unsafe shell expansion in downstream agent execution.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**223 endpoints across 35 platform group(s).**

• Confidence: 93% confidence
• Finding: This skill is explicitly designed to send request data to an external service at api.crawlora.net, so any user-provided search terms, URLs, product identifiers, locations, or other parameters leave the local trust boundary. In a research skill this is expected, but it still creates data-exposure risk if the agent forwards sensitive inputs or if operators assume all processing is local.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Several endpoints go beyond researching products, prices, sellers, and reviews by providing operational fulfillment data such as Costco delivery estimates, IKEA real-time stock availability, Nike product availability, Old Navy in-store pickup stock, and especially Chewy live warehouse inventory quantities and handling flags. These are materially different from the manifest's stated research use cases and expand into logistics/inventory intelligence.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest frames the skill as researching products, prices, sellers, and reviews across online marketplaces and retailers, but this reference also exposes many store-locator endpoints for Costco, H&M, Kohl's, Nike, Old Navy, Walgreens, IKEA, Adidas, Best Buy, Zara, Ulta, CVS, and others. Finding nearby physical stores, addresses, phone numbers, hours, and in-store services is a distinct capability that is not clearly justified by the stated purpose of product-price research.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The file instructs use of an external API with an API key but provides no warning that user queries and parameters will be transmitted to a third-party service. That omission can lead to accidental disclosure of sensitive user data or mishandling of credentials by agents/operators who are not prompted to minimize or sanitize what they send.

Static analysis

No suspicious patterns detected.