Security audit
Security checks for vulnerabilities and agentic risk
This skill is a focused TikTok ad-research helper that discloses its Crawlora API use and does not show hidden persistence, privilege escalation, or unrelated data access.
Install only if you are comfortable sending TikTok ad-research queries and your Crawlora API key to Crawlora. Keep CRAWLORA_API_KEY in an environment variable or secret store, avoid sharing logs that could contain requests or responses, and treat returned ad data as public-signal research rather than proof of advertiser spend or performance causation.
The skill instructs the agent to run a shell script but does not declare any explicit tool restrictions or permissions. That creates an avoidable trust gap: an execution-capable skill can invoke local shell behavior and network access without clear scoping, increasing the chance of unintended command execution or misuse if the skill is modified or composed with other inputs.
The skill requires sending an API key in an HTTP header to an external third-party service, which is a real data egress and secret-exposure boundary. Even though this is expected for the skill's purpose, it still creates risk if the script logs headers, forwards unintended data, or if users do not understand that prompts, query terms, and credentials are leaving the local environment.
Set `CRAWLORA_API_KEY` to your key from [crawlora.net](https://crawlora.net).
Run the bundled `scripts/crawlora.sh` from this skill directory or by absolute
path. It sends `x-api-key` to `https://api.crawlora.net/api/v1` and prints JSON.
Keep the key in the environment. Read [reference/endpoints.md](reference/endpoints.md)
for the ten Top Ads endpoints and their exact parameters.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
This markdown file says the endpoints are used by 'this workflow' and should be called via another script, but it does not specify concrete activation phrases, scope limits, or exclusion conditions for when the skill should be invoked. For markdown files, missing specificity around invocation context can create ambiguity about when the documented capability applies.
The markdown instructs users to supply x-api-key: $CRAWLORA_API_KEY, which involves sensitive credential use, but the file provides no warning about securely storing, handling, or avoiding accidental disclosure of that secret. For markdown files, omission of warnings around privacy or system-integrity-relevant behavior is in scope.