costco-research
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with a third-party API service (api.crawlora.net) to retrieve product and warehouse data. This is the primary purpose of the skill.
- [COMMAND_EXECUTION]: The skill includes a helper script (
scripts/crawlora.sh) that usescurlto make API requests. The script correctly implements argument handling and safely constructs the query string usingcurl -G --data-urlencodeto prevent command injection. - [CREDENTIALS_UNSAFE]: The documentation correctly advises users to manage their API key via an environment variable (
CRAWLORA_API_KEY) and explicitly warns against hardcoding or committing the secret.
Audit Metadata