Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate Crawlora search skill, but it is broader than advertised and can send arbitrary API requests and user-provided data to Crawlora with the user's API key.
Review this before installing if you need strict data-boundary controls. Treat all queries, locations, business names, tickers, and request bodies as data sent to Crawlora and potentially upstream public search services. Use a dedicated low-privilege Crawlora key, avoid sensitive or confidential searches, and prefer a scoped wrapper or endpoint allowlist if this is deployed in a managed environment.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**56 endpoints across 6 platform group(s).**curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
[ -n "$body" ] || body="${rest[0]:-{}}"
curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" -d "$body" "${base}${path}"
fiVirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal