Contact Map Bm

• Outcome: Review
• Latest audit: May 29, 2026 at 9:39 PM UTC
• Version:
  1.0.0

Overview

This skill appears to do what it says, but it can expose Odoo contact details to third-party mapping services and creates a persistent local contact export without enough user control.

Review before installing if your Odoo contacts include customer, employee, or partner data. Use a least-privileged Odoo account, prefer preexisting coordinates or an internal geocoder, avoid broad runs unless approved, and treat the generated HTML map as a sensitive export.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script writes a local HTML file containing names, addresses, email addresses, phone numbers, and direct Odoo record links for up to 10,000 contacts. This exceeds the narrowly stated purpose of generating a map and creates a secondary export of personal data in a user-accessible workspace, increasing retention and disclosure risk if the file is shared, synced, or accessed by other local processes.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger phrases are broad enough to match ordinary user requests such as 'contacts map' or 'show contacts on map,' which could auto-select this skill in situations where the user did not intend Odoo data extraction or third-party geocoding. In this skill's context, that increases the chance of accidental access to contact records and unintended transmission of address data to external services.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill states that it geocodes contact addresses via Nominatim but does not provide a clear user-facing warning that contact address data may be transmitted to an external third-party service. Because the data involved is contact information from Odoo, this omission is significant and can create privacy, compliance, and confidentiality risks if users trigger the skill without realizing data leaves the local/Odoo environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script sends contact address data to the external Nominatim geocoding service, which discloses customer or employee location information to a third party without any consent flow, warning, or privacy guardrail. In this skill context, the data being processed is Odoo contact data, so external transmission materially increases privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.