goplaces

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Google Places CLI helper, with the main caution being trust in the third-party Homebrew tap and protection of the API key.

Install only if you trust the goplaces Homebrew tap and upstream project. Use a dedicated Google Places API key with appropriate API restrictions, quota limits, and billing controls, and rotate it if you later suspect the installed CLI or tap was compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Executable Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 13
Vulnerability Type: Unpinned third-party dependency from a mutable package source
Risk Level: Medium

Evidence

yaml

metadata: {"clawdbot":{"emoji":"📍","requires":{"bins":["goplaces"],"env":["GOOGLE_PLACES_API_KEY"]},"primaryEnv":"GOOGLE_PLACES_API_KEY","install":[{"id":"brew","kind":"brew","formula":"steipete/tap/goplaces","bins":["goplaces"],"label":"Install goplaces (brew)"}]}}

markdown

- Homebrew: `brew install steipete/tap/goplaces`

Technical Analysis

The Skill directs users or an agent runtime to install the goplaces executable from the third-party Homebrew tap steipete/tap. The dependency is not pinned to a specific release, formula revision, source commit, or immutable artifact checksum. The audited package also does not include the formula or executable source, so their installation and runtime behavior cannot be verified from the project contents.

Homebrew formulas and referenced artifacts are retrieved externally. If the tap, its maintainer account, the formula repository, or an upstream release artifact is compromised or changed, the effective code installed by this instruction can differ from the code originally reviewed. Depending on the formula, installation may execute build or installation logic under the privileges of the invoking user.

This finding establishes an insecure supply-chain boundary, but the audited files do not provide evidence that the current tap or binary is malicious.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, or an upstream artifact referenced by the formula.
2. The attacker modifies the formula or distributed goplaces binary while preserving its expected package and executable names.
3. A user or agent follows brew install steipete/tap/goplaces without verifying a fixed version, signature, or checksum.
4. Homebrew retrieves and i ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin goplaces to a reviewed, immutable release rather than installing the latest content exposed by a mutable tap.
2. Pin the Homebrew tap or formula to a verified commit where supported, and record the expected source or binary SHA-256 checksum.
3. Require cryptographic signature verification for release artifacts when the upstream project provides signatures.
4. Prefer an official, trusted distribution channel with reproducible builds and transparent provenance.
5. Review and retain the exact Homebrew formula and corresponding source revision used by the Skill so installation behavior remains auditable.
6. Run the executable with least privilege and restrict its filesystem and network access where sandboxing is available.
7. Supply GOOGLE_PLACES_API_KEY only to the intended process, use a dedicated key with minimal API restrictions and quotas, and rotate the key if dependency compromise is suspected.
8. Add automated dependency integrity monitoring so changes to the tap, formula, release artifact, checksum, or signing identity require renewed security review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.