Back to skill
Skillv1.0.0
ClawScan security
Google Maps Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 13, 2026, 5:15 AM
- Verdict
- suspicious
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code is clearly a Google Maps CLI that only needs a Maps API key, but the package metadata/documentation are inconsistent (it omits the required GOOGLE_MAPS_API_KEY and the bun runtime), so the bundle's declarations don't match its actual requirements.
- Guidance
- This package implements a straightforward Google Maps CLI and will make network requests directly to Google Maps Platform endpoints using your API key. Before installing: 1) Be aware the code expects the environment variable GOOGLE_MAPS_API_KEY (the registry metadata incorrectly omits this); ensure you supply a restricted API key (restrict by API, referrer/IP, and billing limits). 2) The CLI is executed with 'bun' (scripts/gmaps.ts) — you need Bun installed; the registry also omits this runtime requirement. 3) The skill sends your queries to Google (as ?key=... for legacy endpoints or X-Goog-Api-Key header for newer APIs) and prints raw Google JSON to stdout — monitor key usage and billing. 4) The omission of required env/binary declarations looks like sloppy packaging rather than malicious intent, but treat the API key as sensitive and only install if you accept that the skill will use your key to call Google Maps APIs.
Review Dimensions
- Purpose & Capability
- noteThe code and SKILL.md implement a Google Maps CLI calling official Google Maps endpoints (geocode, reverse-geocode, directions, places, elevation, timezone). Those capabilities align with the skill name and description. However the registry metadata lists no required environment variables or binaries even though the CLI requires a GOOGLE_MAPS_API_KEY and is executed with 'bun' — the metadata omission is inconsistent with the stated purpose.
- Instruction Scope
- okSKILL.md instructs the agent to set GOOGLE_MAPS_API_KEY and run 'bun scripts/gmaps.ts'. The runtime instructions and the code limit behavior to building requests to Google Maps Platform endpoints and returning raw Google JSON. The skill does not attempt to read unrelated files, other env vars, or contact non-Google endpoints.
- Install Mechanism
- okNo install spec is provided (instruction-only install), and the repository contains the CLI source. There are no downloads, external install URLs, or archive extraction steps in the manifest — low install risk.
- Credentials
- concernThe runtime and tests require one secret: GOOGLE_MAPS_API_KEY (used as either a query param or X-Goog-Api-Key header depending on API). The registry metadata incorrectly lists no required env vars and no primary credential. The absence of a declared primary credential and the failure to document the required API key in the registry is a material inconsistency that could lead to accidental key exposure or misuse if users assume no credential is required.
- Persistence & Privilege
- okThe skill does not request permanent or global agent privileges (always: false), does not modify other skills or system settings, and does not persist credentials itself. Autonomous invocation is allowed by default but is not combined with other high-risk privileges.