Security audit
Security checks for vulnerabilities and agentic risk
This is a scoped Substack research helper that uses a Crawlora API key to fetch public Substack data and shows no hidden persistence, mutation, or privilege escalation.
Install only if you are comfortable sending your Crawlora API key and Substack research queries to Crawlora. Treat returned writer activity, follower, following, and subscriber-preview data as public but privacy-sensitive, and keep searches bounded to the user's request.
The skill invokes shell-based capability via scripts/crawlora.sh but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an under-constrained execution model where an agent may be permitted broader shell access than intended, increasing the chance of command misuse, unsafe composition with user input, or execution beyond the documented API workflow.
The skill instructs the agent to transmit an API key in an x-api-key header to an external service, which is an external data transmission path. While contacting a third-party API is expected for this skill, it still creates risk because secrets and potentially user-derived query data leave the local environment and depend on the trustworthiness, transport security, and handling practices of the external provider.
Set `CRAWLORA_API_KEY` to your Crawlora key. Prefer the named Crawlora MCP tools
when connected; otherwise use the bundled `scripts/crawlora.sh`, which sends
`x-api-key` to `https://api.crawlora.net/api/v1`. Read
[reference/endpoints.md](reference/endpoints.md) for exact tool names, methods,
and parameters. Check application `code` as well as HTTP status; payloads are
inside `data`. Stop on authentication errors, back off on `429`, and retry a
The manifest describes research on publications, writers, public posts, recommendations, categories, and Notes, which supports content discovery and archive inspection. This file also documents endpoints for enumerating a user's followers/following/subscribers and mixed activity feed, which extends into social-graph and engagement surveillance capabilities not clearly stated in the manifest description.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
No suspicious patterns detected.