Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed rental-housing research helper that sends scoped search requests to Crawlora and does not show hidden persistence, privilege escalation, or destructive behavior.
Install only if you intend to use Crawlora for housing research. Keep CRAWLORA_API_KEY in a secure environment variable, avoid logging it, and remember that search criteria you provide may be sent to Crawlora. Review generated shortlists against original source URLs before making housing decisions.
The skill enables shell-based execution via a bundled script but does not declare any explicit tool scope or permission boundaries. That omission increases the chance an agent may invoke shell capabilities more broadly than intended, reducing least-privilege controls and making misuse or unintended command execution harder to govern.
The skill is explicitly designed to transmit requests to an external API using an authentication key, which creates a real data egress boundary. In this rental-research context, user-supplied search criteria, queries, and other potentially sensitive housing preferences could be sent off-platform to Crawlora, and the presence of an API key increases the sensitivity of any misconfiguration or leakage.
Only the endpoints used by this workflow. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**22 endpoints across 2 platform group(s).**
The manifest describes the skill as researching public rental communities and NYC housing listings or market series for rental shortlist building and asking-rent context. This file documents a streeteasy_sales_search endpoint for sale listings, including sale-specific filters like property taxes, maintenance, sale status, and price per square foot, which extends beyond the stated rental-oriented scope.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The skill instructs users to supply an API key and send it in an HTTP header to an external service, but it does not clearly warn about credential exposure, storage, logging, or transmission risks. In agent environments, secrets can be mishandled through verbose logs, shell history, debugging output, or accidental reuse across contexts.
This markdown file instructs users to call external endpoints at api.crawlora.net and to include the x-api-key header using $CRAWLORA_API_KEY, but it does not include any warning that requests transmit data to a third-party service. Under the markdown-file criteria for missing user warnings, external-network behavior tied to credential use should be disclosed when it could affect privacy or system integrity.
No suspicious patterns detected.