developer-talent-discovery
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill follows best practices for input validation and credential management.
- [EXTERNAL_DOWNLOADS]: The skill facilitates network requests to
api.crawlora.netusing thescripts/crawlora.shhelper. These requests are restricted to the vendor's own API domain and are used solely to fetch dataset information relevant to the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON data fetched from the Crawlora API. This interaction represents a potential surface for indirect prompt injection, though the impact is limited by the skill's restricted capabilities.
- Ingestion points: Public GitHub user and repository data retrieved from
api.crawlora.net. - Boundary markers: None identified in the prompt instructions.
- Capability inventory: The skill is limited to read-only HTTP GET operations against a specific whitelist of API paths.
- Sanitization: The helper script performs strict path validation using anchored regular expressions and ensures all query parameters are URL-encoded.
Audit Metadata