Maps Cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 2.0.1

Overview

The package appears to be a maps CLI, but its install instructions tell users to download and run mutable remote code, so it needs manual review before use.

Install from the reviewed bundled artifact or a pinned release, not the raw GitHub main URL. Avoid sending sensitive home, workplace, customer, or route coordinates unless you are comfortable sharing them with the public OSM-related endpoints, and run the CI verifier only in an isolated environment for trusted code.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:33

Finding

Unpinned Remote Script Retrieval Enables Post-Review Payload Substitution

Content

View full analysis

Remediation

View remediation

/maps_cli.py ``` 3. Publish and verify a SHA-256 checksum before execution: ```bash echo " maps_cli.py" | sha256sum --check - ``` 4. Prefer signed, versioned release artifacts with documented signature verification. 5. Use `curl -fL` so HTTP failures cause installation to stop rather than leaving an error response as a local script. 6. Update both `README.md` and `SKILL.md` so they cannot direct agents away from the reviewed package. 7. Configure CI to reject executable download instructions that reference mutable branches or lack integrity verification. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: maps_cli.py:99

Finding

Unvalidated POI Category Is Interpolated into an Overpass Query

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script advertises a security check for hardcoded secrets, but only scans .py files and only matches a narrow key=value pattern with limited token shapes. This can create a false sense of safety in CI, allowing secrets in markdown, config files, JSON, YAML, env files, or differently formatted Python assignments to pass unnoticed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This helper executes each discovered Python file with a self-test argument, which means an untrusted product being verified can run arbitrary code during CI or local verification. Because the script is explicitly a verification harness for third-party product folders, this turns validation into code execution and can lead to runner compromise, secret exfiltration, or destructive actions.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

Executing discovered test_*.py files in the target folder allows arbitrary attacker-supplied Python code to run during verification. In a CI context this is especially dangerous because untrusted tests can read environment secrets, modify the workspace, or pivot to the network under the guise of validation.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python

# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI sends user-provided place names and coordinates to third-party services such as Nominatim and OSRM without explicit disclosure or consent. In a skill context, this can leak sensitive location data, travel intent, or queried places to external operators, which is a real privacy and data-handling risk even though it is part of the tool's functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The export command transmits user-supplied coordinates and radius to the Overpass API and returns location-based data without any explicit privacy or network disclosure. Because export functionality may be used in bulk or with sensitive coordinates, the skill context makes the privacy impact more significant than a one-off lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown states the skill performs geocoding, routing, POI, timezone lookup, and CSV export, which implies sending user-provided location data to external OpenStreetMap services and potentially writing results to disk. While functionality is described, there is no explicit warning about privacy implications of live queries or that export writes user data to a file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly states elsewhere that it queries OpenStreetMap live, but the main description does not warn users that addresses, coordinates, and POI searches will be transmitted to third-party services. In an agent context, this can cause unintentional disclosure of sensitive location data, especially when users or upstream systems assume the tool operates locally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The inline comment at L104 states that a POST request is needed for Overpass, but the code at L103 performs an additional request via _req(OSM_OVERPASS, None, ...) before constructing the POST request at L105-L109. This is an intent-code divergence because the comment describes the needed behavior while the implementation does extra network activity not reflected by that comment.

Content

No source excerpt is available for this finding.