ClawHub
Back to skill

Security audit

Dataify Bing Maps

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Dataify-backed Bing Maps helper that requires user confirmation before live API calls.

Install this only if you are comfortable sending Bing Maps search terms and optional location parameters to Dataify using your Dataify API token. Review the confirmation table before approving each live call, especially for precise addresses or coordinates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill uses environment access and outbound network access to read a token and call an external API, but it does not declare those capabilities up front. That creates a transparency and consent problem: a user may think this is a simple Bing Maps helper while it actually exfiltrates query data to a third party and consumes secrets from the runtime environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose suggests ordinary Bing Maps assistance, but the skill actually routes user requests to an external Dataify service, handles API credentials, and exposes additional request controls such as cache bypass. This mismatch can mislead users and operators about data flows and trust boundaries, increasing the risk of unauthorized disclosure of location queries and improper credential handling.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation rule is broad enough to trigger on normal Bing Maps usage rather than a clear request to use this specific third-party integration. Over-broad triggering increases the chance that benign map searches are silently diverted to the external service, exposing location-related queries without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger description is broad enough to match many ordinary map- or location-related requests, which can cause the skill to activate when the user did not intend to invoke this specific Bing Maps/Dataify workflow. That increases the chance of unnecessary parameter collection, token prompting, or external API use in contexts where another tool or no tool should have been used.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.