ClawHub
Back to skill

Security audit

Google Maps API

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Google Maps-style API guide that makes paid network requests for places and reviews, with no hidden execution or local persistence found.

Install only if you are comfortable sending place-search queries to fetcher.sh and paying per call or using prepaid credits. Keep the bearer key private and review MCP configuration because enabled tools can make paid API calls when invoked.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:40