Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Crawlora API helper for supplier research, and its network/API-key use is visible, scoped, and consistent with that purpose.
Install only if you are comfortable sending supplier research queries, public URLs, and your Crawlora API key to Crawlora's API. Keep the key in an environment variable, avoid sending confidential business data unless Crawlora is an approved vendor for that data, and review API output before treating shipment evidence as verified supplier capability.
The skill invokes a shell script (scripts/crawlora.sh) but does not declare any tool restrictions such as permissions or allowed-tools. This creates an unnecessary capability gap: an agent executing the skill may have broader shell access than required, increasing the blast radius if the skill, its script, or user-supplied arguments are abused.
The skill transmits an API key via x-api-key to an external service, which is an intentional external data flow and expands the trust boundary. Even though this is expected for the integration, it becomes a security concern if the destination, request contents, logs, or downstream handling are not tightly controlled, because credentials or sensitive research inputs could be exposed.
Set `CRAWLORA_API_KEY` to your key from [crawlora.net](https://crawlora.net).
Run the bundled `scripts/crawlora.sh` from this skill directory or by absolute
path. It sends `x-api-key` to `https://api.crawlora.net/api/v1`; keep the key in
the environment. Read [reference/endpoints.md](reference/endpoints.md) for the
selected ImportYeti, search, and website-extraction tools.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -q -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
The natural-language description states that Bing search defaults to country=us and lang=en-us, and the parameter list repeats those defaults. This imposes a specific locale in the documented behavior without indicating user choice or a documented business justification, which can conflict with language/locale policy expectations.
No suspicious patterns detected.