Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora Airbnb market-research helper that sends user-scoped queries and an API key to Crawlora, with no hidden persistence, privilege escalation, or destructive behavior found.
Install only if you intend to use Crawlora for Airbnb market research and are comfortable sending queries and your Crawlora API key to Crawlora. Keep use bounded to the locations and sample sizes you choose, and avoid using calendar or repeated searches to infer occupancy, revenue, or suppressed individual listing data.
The skill instructs use of a shell script but does not declare any explicit tool scope or permissions boundaries. That creates a governance gap: an agent runtime may allow shell/network access more broadly than intended, increasing the chance of unintended command execution or data access when the skill is invoked.
The skill advertises a market-research workflow that explicitly avoids occupancy or revenue-style analysis, yet it exposes a per-listing availability calendar endpoint. Calendar access can be used to infer occupancy patterns and booking performance for individual listings, which materially expands the data collection capability beyond the declared scope and creates misuse risk.
The manifest describes use of aggregates plus selected live listings, but this endpoint enables broad live Airbnb search over public stays. That broad search capability increases collection scope, facilitates large-scale discovery of listings, and weakens the stated boundary around limited sampling, making the skill easier to repurpose for broader scraping than intended.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Line L07 tells users to send requests to an external API and include x-api-key: $CRAWLORA_API_KEY, but the markdown provides no caution about exposing credentials or sending workflow data to a third-party service. For a documentation file, this is a user-facing omission about privacy and system-integrity relevant behavior.