sports-scores-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the Crawlora API (
api.crawlora.net). This is the intended primary purpose of the skill and uses the vendor's own infrastructure. - [COMMAND_EXECUTION]: The skill executes a bundled Bash script (
scripts/crawlora.sh) to perform API requests. The script implements defensive measures including strict path allowlisting and input validation to prevent arbitrary command injection. - [CREDENTIALS_UNSAFE]: The skill requires an API key (
CRAWLORA_API_KEY) provided via the environment. The helper script securely writes this key to a temporary file with restricted permissions (chmod 600) and usescurl --configto ensure the key does not appear in the process list. The key is never hardcoded. - [DATA_EXFILTRATION]: Network operations are restricted to the Crawlora API. The script explicitly rejects overrides to the base URL, preventing redirection of the API key to third-party hosts.
Audit Metadata