ClawHub
Back to skill

Security audit

Dataify Bing Maps

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Bing Maps search wrapper that sends map queries to Dataify using a user-provided API token.

Install only if you are comfortable with map searches, including any coordinates you provide, being sent to Dataify and with the skill using a DATAIFY_API_TOKEN from your environment. Do not paste the token into chat; configure it as an environment variable as the skill advises.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read `DATAIFY_API_TOKEN` from the environment and make live network calls, but it does not declare corresponding permissions. This creates a trust and transparency gap: a user or platform may approve the skill without understanding that it can access secrets and contact external services.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill sends user-provided search queries and optional GPS coordinates to a third-party API endpoint without any explicit user-facing disclosure or consent mechanism in the code path. Because location data can be sensitive, this creates a privacy risk even though the destination is fixed and the behavior is aligned with the feature's purpose.

Static analysis

No suspicious patterns detected.