event-venue-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script
scripts/crawlora.shto interface with the Crawlora API. The script is hardened against common shell injection vulnerabilities: it uses a path whitelist to restrict requests to specific API routes, validates the format of the API key, and employs curl configuration files to prevent the API key from appearing in process lists. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles an API key (
CRAWLORA_API_KEY) which is used to authenticate with the vendor's official endpoint atapi.crawlora.net. It follows secure practices by not hardcoding credentials and recommending environment variable storage. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external providers (Ticketmaster and TicketWeb). Although external data can theoretically contain malicious instructions, the skill functions as a data-gathering tool and does not grant the agent capabilities that could be easily exploited via prompt injection from the API responses.
Audit Metadata