Skills
Navigate
skills/crawlora-org/crawlora-skills/streaming-availability-comparison/Gen Agent Trust Hub

streaming-availability-comparison

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves movie and show data from an external API (JustWatch via Crawlora), which introduces a theoretical attack surface for indirect prompt injection if the API content were to contain malicious instructions.
  • Ingestion points: External data results returned from scripts/crawlora.sh and processed by the agent.
  • Boundary markers: There are no explicit delimiters instructed for handling the external data output.
  • Capability inventory: The agent uses scripts/crawlora.sh to execute curl commands.
  • Sanitization: The scripts/crawlora.sh script provides robust sanitization by whitelisting specific routes and using --data-urlencode for all query parameters.
  • [SAFE]: The scripts/crawlora.sh script follows security best practices for handling sensitive credentials. It uses mktemp to create a temporary, restricted curl configuration file for the CRAWLORA_API_KEY, preventing the secret from being exposed in process listings or command-line history.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:52 AM