zara-research

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net to retrieve product, category, and store data. This is the primary function of the skill and utilizes the vendor's official API infrastructure.
  • [COMMAND_EXECUTION]: The skill includes a bash script scripts/crawlora.sh that serves as a wrapper for curl. The script implements proper variable quoting and uses curl's --data-urlencode feature to safely handle query parameters, mitigating the risk of command or argument injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Zara catalog which is then processed by the agent. This represents a potential data ingestion surface.
  • Ingestion points: API responses from api.crawlora.net retrieved via scripts/crawlora.sh.
  • Boundary markers: None explicitly defined in the instructions to the agent.
  • Capability inventory: Network communication and shell execution via the provided helper script.
  • Sanitization: The documentation encourages the use of jq to parse and filter the JSON responses, which provides a layer of structural validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 06:10 PM
Security Audit — agent-trust-hub — zara-research