Skills
Navigate
skills/crawlora-org/crawlora-skills/relocation-cost-comparison/Gen Agent Trust Hub

relocation-cost-comparison

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a local shell script located at scripts/crawlora.sh to interact with the Crawlora API.
  • [EXTERNAL_DOWNLOADS]: The skill fetches cost-of-living and housing dataset information from the vendor's API endpoint at api.crawlora.net. This is the intended behavior for the skill's relocation comparison purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes structured data (JSON) retrieved from an external API, which is a common surface for indirect prompt injection.
  • Ingestion points: Output from API calls made via scripts/crawlora.sh as documented in SKILL.md.
  • Boundary markers: Not explicitly defined in the prompt instructions.
  • Capability inventory: Execution of the scripts/crawlora.sh script to fetch data.
  • Sanitization: The scripts/crawlora.sh script includes robust input validation, ensuring the CRAWLORA_API_KEY follows a strict character format and that only specific whitelisted API paths can be requested.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:44 AM