developer-oss-research
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
api.crawlora.net. This is the official API endpoint for the skill's author (crawlora-org) and is used for its primary function of retrieving public data about GitHub repositories and Chrome extensions. - [COMMAND_EXECUTION]: The skill uses a helper script
scripts/crawlora.shto wrapcurlcommands. The script includes safety measures such asset -euo pipefailand properly uses--data-urlencodefor query parameters to prevent simple command injection through user-supplied arguments. - [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API key via an environment variable (
CRAWLORA_API_KEY) and explicitly warns against hardcoding or committing the key to version control. - [DATA_EXFILTRATION]: No sensitive local data access (e.g., SSH keys, cloud credentials) or exfiltration patterns were detected. The network operations are limited to the vendor's API for data retrieval.
Audit Metadata