ClawHub
Back to skill

Security audit

Mapbox MCP Devkit Patterns

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Mapbox development guide, but it normalizes risky token handling and broad account permissions that users should review carefully.

Install only if you are comfortable giving your AI assistant development-time access to Mapbox account operations. Prefer OAuth hosted setup, pin any `npx` bridge package, avoid project-committed MCP configs for secrets, never paste real tokens into shared config files, and create narrowly scoped tokens instead of all-scopes development tokens.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T08 · Insecure Dependencies

Warning
Location
references/setup.md:23
Finding

Unpinned Package Execution Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/setup.md:121
Finding

Mapbox Access Token Embedded in Plaintext Editor Configuration

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/design-patterns.md:48
Finding

Development Tokens Recommended With Excessive Account Scopes

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · AGENTS.md (reported line 129)May include surrounding context.

md
| Tool                  | Purpose               | Example Use                  |
| --------------------- | --------------------- | ---------------------------- |
| **create_token_tool** | Generate access token | "Create token for localhost" |
| **list_tokens_tool**  | Show all tokens       | "List my tokens and scopes"  |

### Validation & Analysis

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
The [Mapbox MCP DevKit Server](https://github.com/mapbox/mcp-devkit-server) is a Model Context Protocol (MCP) server that gives AI assistants direct access to Mapbox developer APIs:

- **Style management** - Create, list, update, delete, preview, validate, compare, and optimize styles
- **Token management** - Generate and list access tokens with scopes
- **Validation** - Validate GeoJSON, expressions, styles, and coordinates
- **Geographic utilities** - Calculate bounding boxes, convert coordinates, query tiles
- **Color tools** - Check WCAG contrast ratios for accessibility

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
The [Mapbox MCP DevKit Server](https://github.com/mapbox/mcp-devkit-server) is a Model Context Protocol (MCP) server that gives AI assistants direct access to Mapbox developer APIs:

- **Style management** - Create, list, update, delete, preview, validate, compare, and optimize styles
- **Token management** - Generate and list access tokens with scopes
- **Validation** - Validate GeoJSON, expressions, styles, and coordinates
- **Geographic utilities** - Calculate bounding boxes, convert coordinates, query tiles
- **Color tools** - Check WCAG contrast ratios for accessibility

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 5)May include surrounding context.

md
## Prerequisites

- Mapbox account with access token
- AI coding assistant that supports MCP (Claude Code, Cursor, Windsurf, Cline, etc.)

## Option 1: Hosted Server (Recommended)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The self-hosted example shows a plaintext MAPBOX_ACCESS_TOKEN embedded directly in configuration, which can be exposed through source control, local file disclosure, backups, screenshots, or shared workstation access. Because this is a setup guide likely to be copied verbatim, it can normalize insecure credential handling and directly lead to token compromise.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 18)May include surrounding context.

md
**Check:**

1. Access token has `styles:write` scope
2. Style name is unique
3. JSON is valid Mapbox Style Spec

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 28)May include surrounding context.

md
**Check:**

1. Access token has `styles:write` scope
2. Style name is unique
3. JSON is valid Mapbox Style Spec

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/workflows.md (reported line 100)May include surrounding context.

md
### Security

- **Never commit access tokens** - Use environment variables
- **Use scoped tokens** - Minimal necessary permissions
- **Add URL restrictions** - Limit to your domains
- **Rotate tokens regularly** - Generate new tokens periodically

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents destructive and credential-generating capabilities such as style deletion and token creation, but it does not warn users that these actions can permanently change resources or mint new credentials. In an AI-assisted workflow, this increases the chance of unsafe or unintended actions being suggested or executed without adequate user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The self-hosted configuration example shows MAPBOX_ACCESS_TOKEN inline, which can normalize placing secrets directly into config files, prompts, or shared documentation. This creates a realistic risk of accidental credential exposure through version control, screenshots, logs, or copied examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly promotes token generation and listing by AI assistants but provides no warning about credential sensitivity, secure storage, least-privilege scoping, or avoiding disclosure in chat/output. In a skill designed for AI-assisted development, this omission increases the chance that users will create overly broad tokens or expose secrets in conversational logs and tool output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow directs users to create environment-specific tokens but omits basic safeguards such as minimum required scopes, secure storage, masking, rotation, and verification that tokens are not printed or persisted insecurely. Because these are operational steps likely to be followed verbatim, the missing warnings materially raise the risk of accidental credential exposure or over-privileged token creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly recommends project-level MCP configuration that can be committed to git, but does not warn that MCP config files may later include sensitive server settings, auth material, or environment references. In an AI-assistant setup guide, this omission increases the chance users will store or publish sensitive configuration in repositories without realizing the persistence and sharing risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The guide recommends a project-local .cursor/mcp.json, which creates persistent local configuration inside the workspace and may be accidentally committed or inherited across collaborators. In MCP contexts, persistence matters because server endpoints and future auth-related settings can become part of project state and unintentionally broaden trust or disclosure.

Content

Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.

For Cursor

Create or edit .cursor/mcp.json (project-local) or ~/.cursor/mcp.json (global):

json
{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents token creation and enumeration workflows, including 'Show me all my Mapbox tokens and their scopes', but it does not warn that tokens are sensitive secrets whose values should not be displayed, shared, or stored insecurely. Although the file includes general best practices later, it does not provide a user-facing warning near these credential-related operations about exposure risk or careful handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file includes a workflow pattern where the AI saves generated styles to styles/home-map.json and explicitly writes JSON to a file. The surrounding documentation presents this as a normal pattern but does not warn users that the skill may modify local files, which is a user-data/system-integrity relevant behavior for markdown under SQP-2.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file includes an example where the AI fixes issues and saves cleaned data to data/locations.json, which is a file write affecting user data. The surrounding troubleshooting content does not provide any warning or disclosure that the workflow may modify files on disk.

Content

No source excerpt is available for this finding.