apk-teardown-research
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's API at api.crawlora.net to submit APK files for teardown and retrieve results. These are legitimate operations to the author's own infrastructure.
- [COMMAND_EXECUTION]: Utilizes a local bash script (scripts/crawlora.sh) to execute curl commands. The script implements several security best practices: input validation via regex whitelists for routes and methods, credential safety using temporary config files to hide the API key from process lists, and local file protection by rejecting the '@' character in parameters to prevent curl from reading local file content.
Audit Metadata