game-price-history-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script
scripts/crawlora.shto perform network requests. This script includes robust security controls, such as restricting operations to GET requests, validating the characters allowed in the API key environment variable, and using a whitelist approach for API endpoints. - [EXTERNAL_DOWNLOADS]: The skill interacts with
api.crawlora.netto retrieve pricing datasets. These connections are made to the vendor's own infrastructure to support the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes game metadata and pricing information from third-party storefronts. The instructions provide specific data processing rules for cents-to-currency conversion and observation-window analysis, which helps focus the agent on data extraction rather than executing instructions found within the data.
- [CREDENTIALS_UNSAFE]: The skill manages a
CRAWLORA_API_KEY. The implementation follows security best practices by using a temporary file with restricted permissions (chmod 600) to pass the secret to curl, ensuring the key is not exposed in the system's process table.
Audit Metadata