kohls-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/crawlora.sh) to interface with the Crawlora API. The script is well-structured, usingset -euo pipefailfor robustness and utilizingcurlwith proper argument handling (--data-urlencode) to prevent shell injection during query parameter construction. - [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API keys via an environment variable (
CRAWLORA_API_KEY) and includes explicit warnings against hardcoding or committing secrets. - [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with
api.crawlora.net, which is the official infrastructure for the skill's author (crawlora-org). No unauthorized third-party downloads or remote code executions were detected.
Audit Metadata