Security audit
Security checks across malware telemetry and agentic risk
This skill appears to support legitimate business review research, but its bundled helper is broader than the stated purpose and can send authenticated requests to arbitrary Crawlora paths or an overridden API host.
Review this skill before installing if you need strict control over outbound business-intelligence queries or API-key use. Use a scoped, rotatable Crawlora key, avoid sensitive internal project names or confidential vendor lists in queries, and consider restricting the helper to the documented read-only endpoints and fixed Crawlora API host.
- Get a free Crawlora API key (2,000 credits/mo, no card) at [https://crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills). - `export CRAWLORA_API_KEY=sk_your_key_here` - All requests: `x-api-key: $CRAWLORA_API_KEY` against `https://api.crawlora.net/api/v1`. Missing/invalid key → `401`. ## How it works
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**28 endpoints across 4 platform group(s).**curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
[ -n "$body" ] || body="${rest[0]:-{}}"
curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" -d "$body" "${base}${path}"
fiset -euo pipefail
: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"
method="GET"
body=""VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal