Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently uses a constrained helper script to fetch public Yahoo network content through Crawlora, with the external API key use disclosed.
Install only if you are comfortable sending Yahoo article URLs, categories, IDs, search suggestions, and sports lookup parameters to Crawlora using your CRAWLORA_API_KEY. Avoid submitting private or internal URLs as article parameters.
The skill explicitly instructs use of a shell helper script (scripts/crawlora.sh) but does not declare any tool scope or allowed-tools restrictions. This creates an authorization gap: an agent may invoke shell access more broadly than intended, increasing the chance of unintended command execution or misuse beyond the documented API calls.
The file explicitly instructs callers to send requests to an external service using an API key, but it provides no user-facing warning that data and request parameters will be transmitted off-platform to Crawlora. In a skill that accepts user-supplied URLs, categories, IDs, and query strings, this omission can cause unintended disclosure of user-provided data and surprise network egress using privileged credentials.
This reference hard-codes use of an external endpoint, https://api.crawlora.net/api/v1, and specifies an API key header for authentication. External transmission is expected for this skill's function, but it still creates a real security concern because user inputs and retrieved targets are sent to a third-party service, potentially exposing sensitive requests, metadata, or internal usage patterns.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**46 endpoints across 8 platform group(s).**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# config supplies the header and is removed automatically on exit.
umask 077
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")