Poi Clean

• Outcome: Review
• Latest audit: Jun 5, 2026 · 11:03 AM UTC
• Version: 0.1.3

Overview

This is a coherent local place-planning skill, but it automatically derives and shares location data with external services in ways users should review before installing.

Review this before installing if location privacy matters. Use an explicit origin instead of vague 'nearby' queries when you do not want device/IP location used, keep AMAP_KEY scoped and out of shared files, and only install CoreLocationCLI from a trusted source. The behavior appears purpose-aligned, but its automatic location fallback and VPN-bypass-oriented IP lookup deserve user control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import json
import subprocess

CLI_PATH = subprocess.run(
    ["which", "CoreLocationCLI"],
    capture_output=True, text=True, timeout=5
).stdout.strip() or "/opt/homebrew/bin/CoreLocationCLI"

• Confidence: 89% confidence
• Finding: CLI_PATH = subprocess.run( ["which", "CoreLocationCLI"], capture_output=True, text=True, timeout=5 ).stdout.strip() or "/opt/homebrew/bin/CoreLocationCLI"

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: When the user asks for nearby results without an explicit origin, the code silently derives location from macOS CoreLocation or IP geolocation and then uses that as active search input. This can disclose or act upon the user's approximate or precise location without a clear consent boundary, which is a privacy/security issue in a location-planning skill.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code will use IP-derived latitude/longitude directly for nearby POI searches whenever no origin is specified, which turns approximate network location into actionable physical-location processing without any consent, notice, or visible gating in this file. Even though this is framed as convenience behavior, location data is sensitive and can expose a user's city/area and habits, especially when combined with search intent such as hospitals, hotels, or entertainment venues.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document discloses exact filesystem locations for search credentials and API keys, including a user home-directory credential file and a project-local environment file. Even without exposing the secret values themselves, this materially lowers the effort for an attacker or malicious plugin with local access to locate and harvest credentials, especially in an agent skill repository where such notes may be broadly accessible.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The module transmits user-supplied addresses and precise coordinates to a third-party mapping API without any consent, notice, or minimization controls visible in this file. In a skill context, location data can be sensitive personal information, so silent transmission increases privacy risk even though the network destination is legitimate.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The function transmits user-supplied addresses to a third-party geocoding service without any built-in disclosure, consent flow, or privacy notice. Addresses can contain sensitive personal or business location information, so sending them externally may create privacy and compliance risks in contexts where users do not expect third-party sharing.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script contacts multiple third-party IP lookup services and then sends the discovered public IP to Amap for geolocation, exposing sensitive network-identifying data to external providers. The stated purpose of preferring a service that may reveal the 'real (non-VPN) public IP' increases privacy risk because it attempts to bypass an expected privacy control and does so without any explicit user consent or disclosure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code automatically acquires device or IP-based location in response to nearby-intent queries and passes it into downstream POI search without an explicit disclosure in the flow. In a skill context, location is sensitive data, and silent collection/transmission increases privacy risk and user surprise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The reverse geocoding helper sends exact latitude/longitude to Amap to turn GPS coordinates into a place label, but the code provides no warning or minimization. Precise coordinates are highly sensitive, and transmitting them to a third party without explicit notice can expose a user's current whereabouts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This path uses IP-based coordinates for searches without any warning or disclosure in the code path, so a user who omits an origin may be unknowingly localized and queried against third-party map providers. That creates a privacy issue because sensitive location inference is performed silently and then transmitted externally to Amap for POI lookup.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.