ClawHub
Back to skill

Security audit

Mapbox iOS Patterns

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Mapbox iOS helper whose location examples fit its mapping purpose, with one privacy caveat about not logging precise coordinates in production.

Reasonable to install as a Mapbox iOS reference skill. Before using the location snippets in a real app, provide a specific location-use explanation, request location only when needed, give users a clear way to stop location following, and do not log precise coordinates in production diagnostics.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The example logs precise latitude and longitude to the console, which can expose sensitive location data through device logs, debugging output, crash reports, or shared diagnostics. In an official integration pattern, developers may copy this directly into production code without adding consent, minimization, or disclosure, increasing the chance of unintended location-data exposure.

Static analysis

No suspicious patterns detected.