Security audit
Security checks across malware telemetry and agentic risk
The skill discloses its anime/manga API use, but its helper script is broader than advertised and can send authenticated requests outside that purpose.
Review before installing. Use only if you are comfortable sending anime/manga searches and IDs to Crawlora, keep CRAWLORA_API_KEY private, and avoid sensitive query terms. The publisher should scope the helper to the documented GET /anime and /manga endpoints and prevent accidental key transmission to alternate API bases.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**12 endpoints across 2 platform group(s).**curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
[ -n "$body" ] || body="${rest[0]:-{}}"
curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" -d "$body" "${base}${path}"
fiset -euo pipefail
: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"
method="GET"
body=""VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal