steam-market-opportunity-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill uses a helper script with robust security measures.
- [COMMAND_EXECUTION]: The skill uses a bash script (scripts/crawlora.sh) to interact with the Crawlora API. The script is highly restricted, enforcing an allowlist of API routes and only permitting GET requests.
- [CREDENTIALS_UNSAFE]: The skill requires a CRAWLORA_API_KEY, which is handled securely by reading from the environment and passing it to curl via a temporary, restricted-access configuration file. This prevents the key from appearing in shell history or process listings.
- [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with the vendor's API at https://api.crawlora.net. No external scripts or executable binaries are downloaded from untrusted sources.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Steam via the Crawlora API. Ingestion points: API responses from api.crawlora.net. Capability inventory: Limited to GET requests via a restricted bash script. Sanitization: Query parameters are URL-encoded. Boundary markers: Not required for the defined workflow. Verdict: Safe due to minimal capabilities.
Audit Metadata