v0.1.0

Broadbandmap Cell Coverage Skill

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:31 AM.

Analysis

This is a straightforward cell-coverage lookup skill, but users should know it sends addresses or coordinates to external map/coverage APIs and can use an optional API key.

GuidanceThis skill appears safe for its stated purpose. Before installing or using it, be comfortable with sending queried addresses or coordinates to external services, use only trusted endpoint overrides, and keep any BroadbandMap API key limited and service-specific.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

references/api-notes.md

If your target API differs, pass `--base-url`, `--endpoint`, and `--param-lat/--param-lon`.

The API target is configurable. That flexibility is disclosed and purpose-aligned, but it means the user or agent can direct requests to non-default hosts.

User impactA mistaken or untrusted endpoint override could send location queries to an unexpected service.

RecommendationUse the default endpoint or only override the base URL and endpoint for trusted BroadbandMap-compatible services.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

scripts/cell_coverage_lookup.py

p.add_argument("--api-key", default=os.getenv("BROADBANDMAP_API_KEY")) ... headers["Authorization"] = f"Bearer {args.api_key}" ... headers["x-api-key"] = args.api_key

The script can read an optional API key from an argument or environment variable and send it as authentication to the selected API host.

User impactIf an API key is configured, it is delegated to the coverage API endpoint used for the lookup.

RecommendationUse a limited-purpose API key and avoid combining credentials with untrusted base-url overrides.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

scripts/cell_coverage_lookup.py

url = f"https://nominatim.openstreetmap.org/search?{q}" ... url = f"{base}{endpoint}?{query}"

The script sends address searches to OpenStreetMap Nominatim and sends latitude/longitude query parameters to the configured coverage API.

User impactThe address or coordinates being checked may be visible to external API providers.

RecommendationAvoid using sensitive private addresses if that external sharing is not acceptable, and review the chosen endpoint before running lookups.