Google Maps Reviews Api Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 AM UTC
• Version: 0.1.2

Overview

The skill appears to do what it advertises, but it unnecessarily tells users to provide an API key through chat and sends review queries to a third-party service.

Review before installing. Use this skill only if you are comfortable sending business/review search terms to BrowserAct and receiving public reviewer profile data. Configure BROWSERACT_API_KEY through a protected environment or secret manager, not by pasting the key into chat; rotate the key if it has already been shared conversationally.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

API Credential Solicitation Through the Conversational Interface

Content

View full analysis

"Since you haven't configured the BrowserAct API Key, please visit the [BrowserAct Console](https://www.browseract.com/reception/integrations) to get your Key." ``` `scripts/google_maps_reviews_api.py:91-98`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) sys.exit(1) ``` ### Technical Analysis The Skill explicitly instructs the Agent to ask the user for a BrowserAct API key and the script tells the user to “Provide it to me.” This encourages disclosure of a reusable credential through the conversational interface. The script itself only reads the credential from `BROWSERACT_API_KEY` and uses it as a Bearer token for the declared BrowserAct service: ```python headers = {"Authorization": f"Bearer {api_key}"} ``` Consequently, transmitting the key through chat is not technically necessary. The least-privilege approach is for the user to configure the credential directly in a protected local environment or secret manager without exposing its value to the Agent, conversation transcript, or surrounding logging infrastructure. The network requests to `https://api.browseract.com/v2/workflow` are consistent with the declar ...[truncated 2084 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires access to an environment variable and performs networked API activity, but it does not declare an explicit tool scope such as allowed tools or permissions. That mismatch weakens least-privilege controls and can cause the agent runtime to invoke code with broader capabilities than users or policy reviewers can easily verify.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description instructs the agent to proactively apply the skill across a very broad set of business-review and market-research requests, which increases the chance of unintended invocation without a clear user request for external data collection. In context, that can trigger network calls and third-party processing of business queries and reviewer data when the user may have expected only general advice or analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented output includes reviewer identifiers and profile metadata such as author_name, author_profile_url, and author_image_url, but the skill provides no warning that it collects and may expose personal or profile-linked data. In this context, the omission is significant because the skill is explicitly marketed for automated extraction and downstream analysis, increasing privacy and compliance risk if agents surface or store unnecessary personal data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/google_maps_reviews_api.py (reported line 15)May include surrounding context.

python

# API Configuration
TEMPLATE_ID = "77806855016940604"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_google_maps_reviews_task(api_key, keywords, language="en", country="us"):
    headers = {"Authorization": f"Bearer {api_key}"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The script sends user-supplied keywords and locale parameters to a third-party service (BrowserAct) over the network. In this skill context, external transmission is expected, but it is still security-relevant because potentially sensitive search terms or business intelligence queries may be disclosed to an external provider without explicit consent, minimization, or policy checks.

Content

Scanner excerpt · scripts/google_maps_reviews_api.py (reported line 31)May include surrounding context.

python

# 1. Start Task
    print(f"Start Task", flush=True)
    try:
        response = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers)
        if response.status_code == 401:
             print(f"Error: Invalid authorization. Please check your API key.", flush=True)
             return None

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function signature sets language="en" and country="us" as defaults, which imposes a specific language and locale when the user does not provide alternatives. This is a natural-language policy concern because the script silently assumes a locale rather than prompting for or documenting an explicit choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.