business-review-trust-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The helper script (
scripts/crawlora.sh) implements strong input validation, including a strict allowlist for API routes and character filtering (e.g., rejecting..,//,?,#, and%in paths) to prevent path traversal and injection attacks. - [SAFE]: API key management follows security best practices by reading from an environment variable and passing the credential to
curlvia a temporary configuration file created withumask 077andchmod 600. This prevents the key from appearing in process listings or command history. - [SAFE]: Network operations are restricted to the vendor's official API domain (
api.crawlora.net) using a hardcoded base URL, preventing redirection to unauthorized hosts. - [SAFE]: The skill uses
curl -G --data-urlencodefor all query parameters, ensuring that user-supplied input is safely encoded and preventing shell command injection through parameters.
Audit Metadata