real-estate-autos-research

• Outcome: Review
• Latest audit: Sep 10, 2026 · 1:11 PM UTC
• Version: 1.0.15

Overview

The skill is mostly a disclosed Crawlora API helper for home and car research, but it also enables under-disclosed Rightmove property endpoints beyond the five platforms advertised.

Review before installing if you only intended to authorize the five named Zillow/Redfin/car platforms. The skill sends your Crawlora API key with requests to Crawlora and can also call Rightmove endpoints documented only in the endpoint reference; install only if that broader real-estate scope and potential credit use are acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/crawlora.sh:77
• Finding: Undeclared Rightmove API Capabilities Exceed the Skill's Documented Scope## Vulnerability Details **File Location**: `scripts/crawlora.sh:77-84` **Related Documentation**: `SKILL.md:2`, `SKILL.md:7-10`, `reference/endpoints.md:141-189` **Vulnerability Type**: Undeclared external API capability and least-privilege scope mismatch **Risk Level**: Medium The skill metadata describes support for five platforms: Zillow, Redfin, CarMax, Autotrader, and Cars.com. However, the executable helper also authorizes eight Rightmove route families that are not disclosed in the skill metadata or primary usage documentation. **Vulnerable code:** ```bash /rightmove/agents) ;; /rightmove/agents/*) ;; /rightmove/autocomplete) ;; /rightmove/commercial/search) ;; /rightmove/new-homes/search) ;; /rightmove/properties/*) ;; /rightmove/search) ;; /rightmove/student/search) ;; ``` The mismatch is visible in the declared scope: ```yaml description: Researches homes and used cars via the Crawlora API — Zillow and Redfin property search/estimates/market trends, plus CarMax, Autotrader, and Cars.com vehicle search and dealer/listing detail — returning clean JSON. ``` ```markdown Search homes and used cars, and pull property/vehicle detail, across five platforms as normalized JSON from the Crawlora API — no scraping listing pages. ``` ### Technical Analysis The shell helper is intended to enforce a restricted catalog of API routes. Its comments explicitly state that unrelated routes and caller-account surfaces must remain unavailable. Nevertheless, the allowlist includes Rightmove operations beyond the five-platform scope represented to users. The endpoint reference confirms that these patterns represent functional capabilities, including property searches, commercial and student-accommodation searches, property details, and estate-agent details containing addresses and telephone numbers. Consequently, this is not merely stale documentation: the executable authorization boundary is broader than the de ...[truncated 1626 chars]
• Remediation: ## Remediation Suggestions 1. If Rightmove is not an intended capability, remove all eight Rightmove patterns from `scripts/crawlora.sh` and remove the corresponding endpoint documentation from `reference/endpoints.md`. 2. If Rightmove is intended, explicitly disclose it in the skill name, metadata description, supported-platform count, usage guidance, examples, and data/privacy notes. 3. Replace broad wildcard route matching with a strict route-and-method authorization table. Validate dynamic path parameters according to their documented formats, such as numeric identifiers where required. 4. Add automated consistency tests that compare the executable route allowlist with the generated endpoint reference and the platforms declared in `SKILL.md`. 5. Deny undocumented routes by default and require a review whenever a new platform or endpoint is added.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The code largely matches the stated home/car research purpose and is clearly constrained to related Crawlora routes. However, it exposes additional real-estate capability via Rightmove endpoints (/rightmove/agents, /rightmove/search, /rightmove/properties/*, etc.), which are not mentioned in the declared description. That is an undeclared external resource/capability and should be flagged. Additionally, the script explicitly states it prints raw JSON to stdout, which is a minor discrepancy from the promise of 'clean JSON,' though this is less significant than the undeclared Rightmove support.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly instructs the user to invoke a shell helper script, but it does not declare any tool restrictions such as allowed tools or permissions. This creates unnecessary execution scope and weakens sandboxing/governance, increasing the chance that a consuming agent can run shell commands without clear policy boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The endpoint reference materially expands the skill’s capabilities beyond the stated manifest by including Rightmove real-estate functions that are not disclosed in the metadata description. This creates a trust and authorization boundary issue: callers, reviewers, or policy systems may approve the skill for Zillow/Redfin/used-car research while the skill can also access an additional property platform and geography, enabling unexpected data retrieval and policy bypass.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script explicitly allows multiple /rightmove/* routes even though the skill metadata only describes Zillow, Redfin, CarMax, Autotrader, and Cars.com. This creates a scope mismatch: callers can access an undocumented data source and potentially retrieve data outside the reviewed/declared capability set, which weakens trust boundaries and review assumptions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.