shopify-research

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 1:11 PM UTC
• Version: 1.0.14

Overview

This is a documented Crawlora API helper for public storefront research, with expected third-party API use and no hidden persistence, destructive behavior, or unrelated local data access found.

Install only if you are comfortable sending public storefront URLs, product handles, and search terms to Crawlora under your Crawlora API key. Do not submit secrets, private internal targets, or proprietary research terms unless that third-party API use is approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code is clearly a constrained Crawlora REST helper, but its behavior does not fully match the description. The biggest mismatch is that the description says it can return data 'for any store by domain,' whereas the script only permits a hardcoded set of API paths and never accepts an arbitrary domain parameter at the helper level. It also exposes route families that are not the declared uniform Shopify storefront schema: J.Crew and Quince use different endpoint names such as categories, product, reviews, stores, navigation, and suggest. Additionally, the actual route catalog includes a generic /shopify namespace not mentioned as such in the description, and some brands lack certain declared capabilities (for example, Gymshark has no search/suggest route in the allowlist). Overall, the implementation is related to the declared purpose, but the description overstates generality and understates the route-specific, partially non-uniform nature of the helper.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs use of a shell helper (`scripts/crawlora.sh`) but does not declare any tool scope or allowed-tools restrictions. That creates an avoidable trust gap: an agent may invoke shell in a broader-than-necessary environment, increasing the chance of unintended command execution or misuse beyond the documented API-calling purpose.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation states that requests are sent to Crawlora with an API key, but it does not warn users that supplied storefront URLs, search terms, handles, and similar identifiers are transmitted to a third-party service. In a research skill, users may assume inputs are processed locally or only against the target storefront, so the missing disclosure increases privacy and trust risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**159 endpoints across 15 platform group(s).**

• Confidence: 79% confidence
• Finding: The skill is explicitly designed to transmit user-controlled parameters to an external API endpoint, which creates a real external data-sharing boundary. In this context that behavior is expected, but it is still security-relevant because user research targets, search queries, and store identifiers may be sensitive business intelligence and are exposed to a third-party provider.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes a skill for researching Shopify-powered storefronts plus 14 named DTC Shopify brands. This file also exposes full J.Crew and Quince endpoint families, which are separate non-Shopify storefront integrations with capabilities like category browsing, reviews, size charts, store locations, navigation, and Algolia-backed search that go beyond the stated Shopify-only scope.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The notes state that '`url` is required on every call' and that there is 'no default store', but earlier sections explicitly describe 14 brand-pinned endpoints that work with no `url` parameter needed. This is an active contradiction within the skill documentation about how the skill should be used.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The script performs an outbound HTTP request to the Crawlora API and authenticates it with the `CRAWLORA_API_KEY`, but at the point of execution there is no confirmation prompt or user-facing log indicating that a network request with authenticated data is being sent. While the header comments describe the API usage, code-file warnings are expected to be visible in the code path as well unless the operation is clearly part of the stated purpose.

Static analysis

No suspicious patterns detected.