crowdfunding-campaign-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled shell script (
scripts/crawlora.sh) to interact with the Crawlora API. This script includes several security controls, such as validating the format of the API key, enforcing a strict whitelist of allowed API endpoints and methods, and ignoring user-level curl configurations to prevent environment-based attacks. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
api.crawlora.net. These requests are necessary for the skill's core functionality and target the vendor's official API endpoint. This communication is documented and intended for research purposes. - [DATA_EXFILTRATION]: The skill transmits the user-provided
CRAWLORA_API_KEYto the Crawlora API for authentication. The helper script takes specific precautions to prevent local file exposure by disallowing the@character in query parameters and avoids leaking the key in process listings by passing it to curl via a temporary configuration file.
Audit Metadata