Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed used-car comparison helper that sends user-selected vehicle and location search parameters to Crawlora, with no evidence of hidden persistence, destructive behavior, or unrelated data access.
Install only if you are comfortable using a Crawlora API key and sending vehicle search details, including ZIP codes or radius inputs you provide, to Crawlora for marketplace lookups. Keep searches within the buyer's stated scope and avoid treating the output as a final valuation or mechanical/history verification.
The skill invokes a shell script (scripts/crawlora.sh) but does not declare any explicit tool scope or allowed-tools boundary. That creates unnecessary ambiguity about what execution capabilities the skill expects, which can lead to broader-than-intended command execution in agents that rely on metadata for permission enforcement.
The skill explicitly supports ZIP-code-based queries and sends that location data to an external third-party API, but this reference provides no user-facing notice, consent step, or minimization guidance. ZIP codes are location data and can reveal a user's approximate area or shopping intent, creating an avoidable privacy exposure when transmitted off-platform.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
The manifest describes comparing used-car asking prices using matched local listings and explaining premiums or discounts by trim, mileage, condition, and location. This file documents CarMax store lookup and store search endpoints that expose store addresses, phone numbers, hours, and store-type metadata, which are not clearly necessary for market-price comparison itself.