ClawHub
Back to skill

Security audit

Spatix

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Spatix mapping integration, with expected external API use, but users should treat location data and the optional unpinned MCP install carefully.

Install only if you are comfortable sending map titles, coordinates, addresses, routes, uploaded datasets, and natural-language location prompts to Spatix. Use pseudonymous agent_id and agent_name values if you use leaderboard attribution. For the optional MCP server, prefer a pinned and reviewed spatix-mcp version and run it with limited access to local files and secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–54
Vulnerability Type: Unpinned external dependency installation and execution
Risk Level: Medium

Vulnerable Code

bash
pip install spatix-mcp
# or
uvx spatix-mcp

Technical Analysis

The documentation instructs users to install or immediately execute spatix-mcp from an external package registry without specifying an exact version or verifying an integrity hash.

Because dependency resolution selects the currently available package release, the effective code can change after this skill has been reviewed. The uvx command is particularly sensitive because it resolves the external package and runs its executable directly. The MCP implementation is not included in the audited artifact, so its runtime behavior cannot be verified as part of this audit.

This finding does not establish that the current package is malicious. It identifies a supply-chain trust weakness through which a compromised publisher account, registry compromise, or malicious future release could introduce attacker-controlled code.

Attack Path

  1. An attacker compromises the package publisher account, package registry, or release process for spatix-mcp.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented pip install spatix-mcp or uvx spatix-mcp instruction.
  4. The package manager resolves the attacker-controlled release because no reviewed version or integrity hash is required.
  5. Installation hooks or the package executable run with the permissions of the invoking user.
  6. The malicious package accesses resources available to that user or performs additional unauthorized actions.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running the installation or MCP server. Depending on that user's environment, exposed resources could include local files, environment vari ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact version that has been reviewed, for example:

    bash
    pip install spatix-mcp==REVIEWED_VERSION
uvx spatix-mcp==REVIEWED_VERSION

  2. Publish trusted cryptographic hashes and require hash verification during installation, such as through a locked requirements file used with pip --require-hashes.

  3. Maintain a dependency lock file or equivalent reproducible environment so installations cannot silently resolve newer releases.

  4. Avoid recommending implicit latest-version execution through uvx.

  5. Verify package provenance, publisher identity, release signatures, and source-to-package correspondence before approving upgrades.

  6. Run the MCP server with least privilege in an isolated environment that does not expose unnecessary files, secrets, environment variables, or host tools.

  7. Re-audit each dependency update before changing the documented pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently supports geocoding, routing, place search, and mapping from addresses, but it does not clearly warn that user-supplied addresses and location data are sent to a third-party API. This can lead agents or users to disclose sensitive location information externally without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example sends map data to an external service at api.spatix.io, which is expected for the skill but still represents external transmission of user data. In this skill context, the danger is not the existence of network access itself but the lack of strong warnings about what data is being shared and whether it may be sensitive.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Option 1: Direct API (no setup)

bash
# Create a map from GeoJSON — no auth needed
curl -X POST https://api.spatix.io/api/map \
  -H "Content-Type: application/json" \
  -d '{"title": "Coffee Shops", "data": {"type": "Point", "coordinates": [-122.42, 37.77]}}'
# Returns: {"url": "https://spatix.io/m/abc123", "embed": "<iframe>..."}

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example sends map data to an external service at api.spatix.io, which is expected for the skill but still represents external transmission of user data. In this skill context, the danger is not the existence of network access itself but the lack of strong warnings about what data is being shared and whether it may be sensitive.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Option 1: Direct API (no setup)

bash
# Create a map from GeoJSON — no auth needed
curl -X POST https://api.spatix.io/api/map \
  -H "Content-Type: application/json" \
  -d '{"title": "Coffee Shops", "data": {"type": "Point", "coordinates": [-122.42, 37.77]}}'
# Returns: {"url": "https://spatix.io/m/abc123", "embed": "<iframe>..."}

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run uvx spatix-mcp without pinning a specific version, so future installs may pull a different package release than the one reviewed. This creates a supply-chain risk where a compromised or malicious new release could be executed in the agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

Base URL: https://api.spatix.io

Auto-generated OpenAPI docs: api.spatix.io/docs

Create a Map

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

Base URL: https://api.spatix.io

Auto-generated OpenAPI docs: api.spatix.io/docs

Create a Map

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

Base URL: https://api.spatix.io

Auto-generated OpenAPI docs: api.spatix.io/docs

Create a Map

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

Base URL: https://api.spatix.io

Auto-generated OpenAPI docs: api.spatix.io/docs

Create a Map

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example posts free-form text to api.spatix.io to generate maps from natural language, which can include sensitive operational or personal location information. Because the skill is designed around third-party API use, this is contextually expected but still risky if users are not warned before transmission.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

Visualize locations from text:

bash
curl -X POST https://api.spatix.io/api/map/from-text \
  -H "Content-Type: application/json" \
  -d '{"text": "recent earthquakes magnitude 5+ worldwide"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The example posts free-form text to api.spatix.io to generate maps from natural language, which can include sensitive operational or personal location information. Because the skill is designed around third-party API use, this is contextually expected but still risky if users are not warned before transmission.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

Visualize locations from text:

bash
curl -X POST https://api.spatix.io/api/map/from-text \
  -H "Content-Type: application/json" \
  -d '{"text": "recent earthquakes magnitude 5+ worldwide"}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The leaderboard and agent attribution feature encourages submission of agent_id and agent_name but does not clearly warn that these identifiers and contribution activity are publicly tracked. This may expose operator, organization, or workflow metadata that users did not expect to disclose.

Content

No source excerpt is available for this finding.

Rp1

Low
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The documentation recommends pip install spatix-mcp without version pinning, which allows installation of whatever the latest package version is at execution time. If the package or maintainer account is compromised, users may install unreviewed code into their environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.