Security audit

OSRM Maps Skill

Security checks for vulnerabilities and agentic risk

Overview

This maps skill does what it says: it geocodes places and calculates route summaries using public mapping services, with no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you are comfortable sending place names and precise coordinates to public Nominatim/OpenStreetMap and OSRM services. Avoid using it for sensitive home, work, medical, legal, or confidential travel locations unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code’s core behavior is OSRM route summary lookup between two coordinate pairs. That aligns partially with the declared distance/travel-time/routing theme and the use of OSRM without an API key. However, the declaration explicitly includes geocoding via Nominatim/OSM and use cases involving converting place names to coordinates, which this code does not implement at all. It also does not accept place names as input—only numeric lat,lon pairs. Additionally, while described as suitable for 'directions,' this chunk requests steps=false and returns only aggregate distance and duration, not actual directions. Therefore the description overstates the implemented capabilities in this supplied code chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill explicitly relies on external mapping APIs, which means it has network capabilities, but the manifest does not declare any tool scope or permissions. This weakens governance and user awareness around outbound data flows, especially because location queries may contain sensitive travel or place information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger language is broad enough to match many ordinary conversations about places, distance, or travel, increasing the chance of unintended invocation. Because the skill sends queries to third-party mapping services, accidental activation can cause unanticipated data disclosure or unnecessary external requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation does not warn that user-supplied place names and coordinates are transmitted to public third-party services such as OSRM and Nominatim. Location data can be sensitive, so omitting this disclosure undermines informed consent and increases privacy risk if the skill is invoked with home, work, or travel-related queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script transmits precise user-supplied origin and destination coordinates to the public OSRM routing service, which is a third party outside the local trust boundary. Even though this is necessary for the feature and not malicious, the skill does not provide an explicit runtime privacy notice or obtain consent before sending potentially sensitive location data, which can expose home, work, or travel patterns.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that geocoding and routing use Nominatim and OSRM public services, but it does not clearly warn users that the locations or coordinates they provide are transmitted to third-party servers. This creates a privacy and data-handling transparency issue, especially when users may submit home, work, or other sensitive location data assuming processing is local.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script sends raw user-provided place names to the external Nominatim geocoding service, which can expose potentially sensitive location queries to a third party. In this skill's context, external geocoding is the intended functionality, so the issue is not code execution or injection, but a privacy/transparency weakness because users are not explicitly warned at runtime that their input will leave the local environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.