used-car-price-history-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were identified. The skill is a legitimate data analysis tool and follows secure coding practices.
- [CREDENTIALS_UNSAFE]: The skill requires a
CRAWLORA_API_KEYbut correctly handles it as an environment variable rather than hardcoding it. The helper scriptscripts/crawlora.shprotects the key by writing it to a temporary file with restricted permissions (chmod 600) and using curl's--configflag, which prevents the key from being visible in the system's process list. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
api.crawlora.net, which is the official endpoint for the skill's author (crawlora-org). This is a legitimate vendor resource used for retrieving vehicle listing data. - [COMMAND_EXECUTION]: The bash helper script
scripts/crawlora.shimplements defensive programming by using strict input validation for the API key and a regular-expression-based whitelist for allowed API paths, effectively preventing command injection and path traversal attacks. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface via the Crawlora API (ingestion point:
api.crawlora.net). The risk is mitigated by the skill's specific instructions for structured output (ledger and matched-comparable tables) and the helper script's restricted capability (inventory:curlfor data retrieval only; sanitization: strict regex path validation).
Audit Metadata