Security audit

dmap-jsapi-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only DMap JavaScript mapping guide with insecure copy-paste examples, but no evidence that the skill itself performs hidden or harmful actions.

Install only as API reference material, not as production security guidance. Replace the sample HTTP/private-IP endpoints with approved HTTPS services, avoid or sanitize raw HTML in markers and popups, disable or explicitly govern telemetry where needed, and enable precise location tracking only after clear user consent with a visible way to stop it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill claims 'production-grade secure defaults' but its quick-start examples use plain HTTP for the CSS, JS, and backend service URL. This can enable man-in-the-middle tampering, script injection, credential/session leakage, and mixed-content failures when integrated into real applications. In a developer-facing skill, insecure examples are especially risky because users often copy them verbatim into production code.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples instruct users to load third-party code and configure a backend service over HTTP without warning about confidentiality, integrity, and supply-chain risks. Because this is a copy-paste setup section for frontend developers, it materially increases the chance that insecure transport and internal network endpoints will be adopted in deployed applications.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example enables high-accuracy geolocation and continuous user-location tracking without any accompanying privacy notice, consent guidance, or data-handling caveats. In a developer skill, this can normalize copy-pasting privacy-sensitive code and lead downstream applications to collect precise location data without adequate user awareness or minimization.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The example error handler logs and forwards `e.error.message` and `e.error.stack`, which can expose internal implementation details, file paths, tokens embedded in errors, or other sensitive diagnostic data if copied into production code or sent to centralized logs. In a developer guide, this is not overtly malicious, but it is still a real security weakness because documentation examples strongly influence downstream usage.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation states that `performanceMetricsCollection` defaults to `true`, meaning performance data may be collected and sent without any accompanying privacy notice, consent guidance, or recommendation to disable it where telemetry is undesired. In a developer skill, this can lead downstream users to unknowingly ship software that performs telemetry by default, creating privacy, compliance, and data-governance risk.

Static analysis

No suspicious patterns detected.