restaurant-food-delivery-research

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 1:29 PM UTC
• Version: 1.0.16

Overview

This skill is a read-only food and delivery research wrapper that sends user queries and location data to Crawlora, with a broader provider catalog than its short description emphasizes.

Install only if you are comfortable sharing restaurant, grocery, delivery, and location queries with Crawlora. Review reference/endpoints.md because the usable catalog is broader than the short description, and avoid sending precise home addresses unless needed for the specific search.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description narrows user expectations to a small set of food-delivery and restaurant providers, while the referenced endpoint surface appears broader and includes undeclared third-party services and retail/catalog access. This mismatch is dangerous because reviewers and downstream agents may under-assess the skill's reach, causing overbroad data access or unintended use of providers not covered by the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The endpoint reference materially exceeds the skill's declared scope, exposing 281 endpoints across 40 platform groups instead of just Yelp, OpenTable, DoorDash, Uber Eats, and Instacart. That creates an over-privileged skill surface where a caller or downstream agent can use unrelated food, convenience, retail, loyalty, and location-discovery endpoints, increasing the chance of policy bypass, unintended data collection, and misuse beyond user expectations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill explicitly instructs use of a shell helper script to make outbound API calls, but it declares no tool scope or allowed-tools restrictions. That creates an authorization gap where an agent may be permitted to invoke shell capabilities more broadly than necessary, increasing the chance of unintended command execution or misuse beyond simple API access.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**281 endpoints across 40 platform group(s).**

• Confidence: 83% confidence
• Finding: This skill transmits user-supplied query data to an external service at api.crawlora.net using an API key, which is a real external data-transfer boundary. External transmission is inherent to the skill's function, but it remains a security-relevant risk because restaurant, grocery, and delivery queries often contain sensitive location data and can be combined with behavioral preferences.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file explicitly documents transmission of precise latitude/longitude, postal codes, and full addresses to an external API, but provides no user-facing privacy disclosure, minimization guidance, or consent boundary. In a location-driven food-delivery skill, precise location is expected, but silently forwarding it to a third-party service still creates meaningful privacy risk if users are not informed.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented capabilities include convenience stores, pharmacies, loyalty/rewards catalogs, promotions, and other retail research not justified by a restaurant and grocery delivery research skill. Even if each endpoint is public, bundling them here broadens what the agent can retrieve and infer about users' interests and locations, which can be exploited for unintended profiling or off-purpose actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper permits a much broader set of Crawlora routes than the skill metadata advertises, including many third-party restaurant and delivery providers outside the declared Yelp/OpenTable/DoorDash/Uber Eats/Instacart scope. This creates a capability mismatch: callers or downstream agents may invoke undocumented endpoints and exfiltrate user queries to additional external services the user did not reasonably consent to via the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill is presented as a research/search utility, but the enabled endpoints include operational surfaces such as reservations, availability, fulfillment times, deals, promotions, rewards, and similar action-oriented capabilities. Even if these are read-only API calls, they broaden the semantic scope of the skill and can cause agents to use it in ways users did not intend or approve.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.