Skills
Navigate
skills/crawlora-org/crawlora-skills/luxury-resale-research/Gen Agent Trust Hub

luxury-resale-research

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests listings and metadata from external marketplaces, which could contain instructions meant to override the agent's behavior.\n
  • Ingestion points: Marketplace data is retrieved via scripts/crawlora.sh using the endpoints documented in SKILL.md.\n
  • Boundary markers: The SKILL.md file defines a strict workflow and reporting format that requires the agent to separate different types of evidence and explicitly state gaps.\n
  • Capability inventory: The scripts/crawlora.sh script provides network read capabilities using curl.\n
  • Sanitization: The helper script uses --data-urlencode for query parameters and validates the format of the CRAWLORA_API_KEY environment variable to prevent injection attacks.\n- [DATA_EXFILTRATION]: The skill performs network operations to api.crawlora.net. These requests are necessary to fetch the resale data from the vendor's API and are documented as the primary function of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 01:03 AM
Security Audit — agent-trust-hub — luxury-resale-research