macys-research

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash helper script scripts/crawlora.sh that uses curl to perform network operations. The script implements secure argument parsing using bash arrays and the --data-urlencode flag to ensure that user-supplied query parameters are handled safely and do not lead to shell injection.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net to retrieve product information and metadata. This communication is the primary intended function of the skill and originates from a vendor-controlled domain related to the author (crawlora-org).\n- [DATA_EXPOSURE]: API authentication is managed through the CRAWLORA_API_KEY environment variable. The documentation correctly instructs users on how to set this variable, following best practices for credential management by avoiding hardcoded secrets within the skill files.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 06:10 PM
Security Audit — agent-trust-hub — macys-research