Dataify Bing Maps

• Outcome: Pass
• Latest audit: Jun 2, 2026, 2:25 AM
• Version:
  1.0.0

Overview

This skill is a disclosed Bing Maps/Dataify API helper that requires user confirmation before sending map queries to the external service.

Before installing, understand that confirmed map searches, coordinates, place IDs, and your Dataify token are sent to Dataify's API. Review the displayed parameter table before confirming, especially for sensitive home, work, or travel locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger condition is broad enough to fire on ordinary Bing Maps usage without a clear boundary for when the skill should activate. Overbroad invocation increases the chance that routine location searches, coordinates, or place identifiers are sent to the external service unintentionally, expanding privacy exposure and surprise execution. Because this skill performs live network calls, accidental triggering has real security and data-handling consequences.

VirusTotal

65/65 vendors flagged this skill as clean.