Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora/TrustMRR research helper that sends an API key and research requests to Crawlora for startup diligence.
Install this only if you are comfortable sending your Crawlora API key, search parameters, and selected public website URLs to Crawlora. Keep use limited to acquisition research, verify financial claims independently, and treat marketplace scores or seller asking prices as diligence inputs rather than conclusions.
The skill instructs use of a bundled shell script but declares no explicit tool scope or permissions boundary. That creates an authorization gap: an agent or runner may permit shell execution implicitly, increasing the chance that the script can perform actions beyond the intended research workflow, including local environment access or uncontrolled network activity.
The skill is described as screening startups using Crawlora's TrustMRR marketplace, stored company records, and daily metric history for acquisition diligence. The documented web_scrape endpoint adds a broad capability to fetch arbitrary public URLs in markdown/HTML/browser-rendered form, which is not justified by that narrowly defined TrustMRR-focused purpose.
The manifest limits the skill to screening startups listed for sale using TrustMRR, stored company records, and daily metric history. The bing_search endpoint enables open-ended web search across the public web, which materially expands the skill's capability beyond the declared data sources and purpose.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
The endpoint reference states that Bing search defaults to country=us and lang=en-us, and the parameter descriptions repeat those defaults. This is a natural-language locale policy concern because it establishes a specific language/region behavior by default without indicating user choice or opt-in.