ClawHub
Back to skill

Security audit

Dataify Google Map Details

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it can auto-invoke a third-party Google Maps collection workflow and reuse a saved Dataify token without a fresh confirmation.

Install only if you expect the agent to create Dataify Google Maps collection tasks for you. Before use, confirm which saved DATAIFY_API_TOKEN will be used, review the exact URL/CID/location/place ID parameters, and be aware that submitted jobs go to Dataify and may affect your Dataify account or usage quota.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to access environment variables and make outbound network requests, but no explicit permissions are declared. That mismatch weakens the trust boundary: a reviewer or runtime may not realize the skill can read local secrets such as DATAIFY_API_TOKEN and transmit data to an external service. In a skill that handles API credentials and submits remote jobs, undeclared env/network capability is materially security-relevant.

Vague Triggers

Medium
Confidence
91% confidence
Finding
技能描述包含大量宽泛、近义且日常化的“采集/抓取/信息获取”触发短语，容易在用户仅泛泛提到 Google 地图数据时被误选或自动路由到该技能。该技能一旦被误触发，会进入凭证获取、参数收集和外部任务提交流程，因此上下文使此问题比普通描述歧义更危险。

Missing User Warnings

Medium
Confidence
95% confidence
Finding
技能指示在用户未再次提供凭证时自动检查并复用本地保存的 DATAIFY_API_TOKEN，但未要求针对当前请求进行显式确认，也未向用户清楚说明将使用已存凭证访问第三方服务。这样会导致用户在不了解的情况下触发外部 API 调用，造成凭证滥用、越权代表用户操作或隐私预期落差。

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill enables implicit invocation, allowing the agent to auto-select and run a capability that submits external Dataify Google Maps collection tasks without an explicit user request scoped to a specific action. Because the description includes many broad scraping and troubleshooting triggers, this increases the chance of unintended activation and external data collection, which can lead to overbroad scraping, privacy issues, or unreviewed third-party API use.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.