Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Shop.app research helper that sends user-directed product or shop queries to Crawlora and does not show hidden persistence, privilege escalation, destructive behavior, or unrelated data access.
Install only if you are comfortable using Crawlora as a third-party API for Shop.app research. Set the API key in CRAWLORA_API_KEY, do not paste secrets or unrelated personal data into search parameters, and expect product/shop queries and public identifiers to be sent to api.crawlora.net.
The skill invokes shell commands (scripts/crawlora.sh ...) but does not declare any explicit tool scope or allowed-tools policy. That creates unnecessary ambient authority: a runtime may permit broader shell access than the skill actually needs, increasing the blast radius if the skill is misused or later modified.
This skill is designed around external network access to api.crawlora.net, so data entered by the user will leave the local environment. That is expected functionality, but it still represents a real security/privacy boundary because prompts, queries, shop handles, product IDs, and possibly behavioral metadata are transmitted to a third party.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**16 endpoints across 1 platform group(s).**
The file explicitly instructs use of an external API and an API key header but provides no user-facing disclosure, consent guidance, or handling constraints for outbound data. In a skill that researches products and shops, user queries and derived identifiers may be transmitted off-platform without transparency, creating privacy and credential-handling risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints are used by the skill and points to another file for calling them, but it does not define any specific activation phrases, boundaries, or negative examples. For a manifest/markdown-scoped trigger review, that leaves invocation scope ambiguous and could contribute to unintended activation if this file is used as descriptive skill metadata.
No suspicious patterns detected.