Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent relocation-cost comparison helper that uses a disclosed Crawlora API key and fixed external API endpoint without hidden persistence or destructive behavior.
Install only if you are comfortable sending city, housing-market query details, and your Crawlora API key to Crawlora. Keep the API key in an environment variable, avoid including sensitive personal details in search parameters, and monitor API credit use for broad comparisons.
The skill invokes a shell script (scripts/crawlora.sh) but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent runtime may permit broader shell execution than intended, increasing the chance of unintended command execution or access beyond the skill's stated purpose.
The skill explicitly directs use of an external API endpoint and requires transmitting request data plus an API credential to a third-party service. In a relocation-cost-comparison skill this is contextually expected, but it still creates a real data-flow boundary where user-supplied location or budget inputs may leave the local environment and where the API key could be mishandled by downstream tooling or logs.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**7 endpoints across 2 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file documents use of an x-api-key header and external API calls to api.crawlora.net, which affects privacy and credential handling. The file describes how to call the endpoints but does not include any warning or disclosure about sending requests to a third-party service or protecting the API key.
No suspicious patterns detected.