anime-manga-research
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements secure credential management by instructing the user to store the API key in an environment variable (
CRAWLORA_API_KEY) rather than hardcoding it in scripts or configuration files. - [COMMAND_EXECUTION]: The provided helper script
scripts/crawlora.shusescurlwith--data-urlencodeto safely handle query parameters, preventing basic shell injection during API calls. - [EXTERNAL_DOWNLOADS]: All network operations are directed to the vendor's official API domain (
api.crawlora.net). These requests are part of the skill's primary research purpose and represent legitimate vendor functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (such as anime synopses and character descriptions) from the Crawlora API. While this introduces a standard ingestion surface, the skill is a data retrieval tool and does not provide high-privilege capabilities that would lead to escalation. The agent should treat all API-returned text as data rather than instructions.
Audit Metadata