ClawHub
Back to skill

Security audit

address2lnglat

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it uses Baidu Maps to turn place names into coordinates and saves the results as CSV and JSON files.

Install only if you are comfortable sending the searched place names and your Baidu Maps AK to Baidu Maps APIs. Use a restricted AK where possible, avoid sensitive location lists, and remember that CSV/JSON outputs will be saved locally in the run directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions, yet its documented behavior clearly requires network access to Baidu APIs and local file creation for CSV/JSON outputs. This mismatch can mislead reviewers and users about the skill's actual capabilities, reducing informed consent and making unsafe execution more likely.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states it will save CSV/JSON files and directly send the CSV to the user, but it does not clearly warn about local file creation or outbound sharing of generated data. Because the input may include sensitive location lists, silent persistence and transmission can expose user or organizational data beyond what the user expected.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal