geocode

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

The geocoding provider can see the coordinates being looked up and the configured User-Agent.

Why it was flagged

The script sends the supplied latitude and longitude to the configured geocoding provider. This is disclosed and necessary for the skill, but it is still an external data flow involving location data.

Skill content

base_url="${GEOCODE_BASE_URL:-https://geocode.com.cn}" ... --data "lat=$latitude" ... --data "lon=$longitude"

Recommendation

Use this skill only for coordinates you are comfortable sending to the configured provider; use a trusted self-hosted endpoint via GEOCODE_BASE_URL for sensitive locations.