tesla-jobs-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with 'api.crawlora.net', which is the official domain of the skill author (crawlora-org). All external requests are routed through this trusted infrastructure.
- [SAFE]: Secret management follows industry best practices. The
scripts/crawlora.shhelper reads the API key from an environment variable (CRAWLORA_API_KEY) and passes it tocurlvia a temporary configuration file with restricted permissions (chmod 600). This prevents the key from appearing in process lists (ps) or shell history. - [SAFE]: The helper script implements robust input validation, including checks for invalid path characters, restriction to a specific set of allowed API routes, and filtering of the API key format to prevent shell injection or configuration smuggling.
- [SAFE]: All operations are read-only (GET requests) targeting public career data, with no capability for data exfiltration, persistence, or privilege escalation.
Audit Metadata