Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Twitch research helper that sends user-requested public Twitch lookups to Crawlora using an API key, with scoped routes and no persistence.
Install only if you are comfortable sending Twitch lookup requests and your Crawlora API key to Crawlora. Keep CRAWLORA_API_KEY out of code and commits, and use the provided helper rather than modifying it to call unrelated routes.
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. #
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fiNo suspicious patterns detected.