zara-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
api.crawlora.netto retrieve product, category, and store data. This is the primary function of the skill and utilizes the vendor's official API infrastructure. - [COMMAND_EXECUTION]: The skill includes a bash script
scripts/crawlora.shthat serves as a wrapper forcurl. The script implements proper variable quoting and usescurl's--data-urlencodefeature to safely handle query parameters, mitigating the risk of command or argument injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Zara catalog which is then processed by the agent. This represents a potential data ingestion surface.
- Ingestion points: API responses from
api.crawlora.netretrieved viascripts/crawlora.sh. - Boundary markers: None explicitly defined in the instructions to the agent.
- Capability inventory: Network communication and shell execution via the provided helper script.
- Sanitization: The documentation encourages the use of
jqto parse and filter the JSON responses, which provides a layer of structural validation.
Audit Metadata