macys-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash helper script
scripts/crawlora.shthat usescurlto perform network operations. The script implements secure argument parsing using bash arrays and the--data-urlencodeflag to ensure that user-supplied query parameters are handled safely and do not lead to shell injection.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests toapi.crawlora.netto retrieve product information and metadata. This communication is the primary intended function of the skill and originates from a vendor-controlled domain related to the author (crawlora-org).\n- [DATA_EXPOSURE]: API authentication is managed through theCRAWLORA_API_KEYenvironment variable. The documentation correctly instructs users on how to set this variable, following best practices for credential management by avoiding hardcoded secrets within the skill files.
Audit Metadata