Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed restaurant menu benchmarking helper that calls Crawlora's API with a user-provided key and does not show hidden persistence, privilege escalation, or unrelated data access.
Install only if you are comfortable sending your Crawlora API key and benchmark queries, including coordinates and restaurant identifiers, to Crawlora. Keep the key scoped to this service, monitor API credit usage, and avoid using the skill for sensitive unpublished business plans unless Crawlora is an approved vendor for that data.
The skill instructs use of a bundled shell script but does not declare any explicit tool scope or permissions boundary. That creates an execution-trust gap: an agent may invoke shell capabilities without a clearly constrained allowlist, increasing the chance of unintended command execution or abuse if the script or surrounding workflow is modified.
The skill requires transmitting an API key in an HTTP header to an external service, which is a real data egress and secret-handling risk. While this is expected for the stated functionality, any external transmission of credentials and queried business data expands the trust boundary and could expose secrets or sensitive request data if the script, logging, or endpoint handling is unsafe.
Set `CRAWLORA_API_KEY` to your key from [crawlora.net](https://crawlora.net).
Run the bundled `scripts/crawlora.sh` from this skill directory or by absolute
path. It sends `x-api-key` to `https://api.crawlora.net/api/v1`; keep the key in
the environment. Read [reference/endpoints.md](reference/endpoints.md) for the
selected endpoints, required parameters, limits, and response behavior.
Check the application `code` as well as HTTP status; successful payloads are
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")