Google Maps Search Api Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 AM UTC
• Version: 0.1.2

Overview

The skill does what it claims, but it asks users to share a reusable API key in chat and can trigger broad business/contact-data collection workflows without enough guardrails.

Review before installing. Use this only if you are comfortable sending search terms and workflow data to BrowserAct. Configure BROWSERACT_API_KEY through an environment variable or approved secret manager, not by pasting the key into chat. For lead generation or CRM export, confirm that the collection and use of business/contact data complies with applicable laws, platform terms, and your organization’s policies.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18

Finding

Unsafe Solicitation of BrowserAct API Credentials Through Agent Conversation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-22; scripts/google_maps_search_api.py:93-98
Vulnerability Type: Credential exposure through insecure secret-handling instructions
Risk Level: Medium

Vulnerable Code

SKILL.md:18-22:

markdown

## 🔑 API Key Setup
Before running, check the `BROWSERACT_API_KEY` environment variable. If not set, do not take other measures; ask and wait for the user to provide it.
**Agent must inform the user**:
> "Since you haven't configured the BrowserAct API Key, please visit the [BrowserAct Console](https://www.browseract.com/reception/integrations) to get your Key."

scripts/google_maps_search_api.py:93-98:

python

if not api_key:
    print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True)
    print("Please follow these steps:", flush=True)
    print("1. Go to: https://www.browseract.com/reception/integrations", flush=True)
    print("2. Copy your API Key.", flush=True)
    print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True)

Technical Analysis

The Skill explicitly instructs the Agent to ask the user to provide a BrowserAct API key, and the script repeats that the user may provide the key “to me.” This encourages disclosure of a reusable bearer credential through the conversational interface.

Credentials submitted in a conversation may be retained in chat history, Agent execution traces, application telemetry, support records, or other logs. The disclosure is unnecessary because the script already reads the credential from the BROWSERACT_API_KEY environment variable.

The script later places this value into an authorization header:

python

headers = {"Authorization": f"Bearer {api_key}"}

Sending that header to the documented BrowserAct HTTPS endpoint is necessary for the declared hosted API functionality. The vulnerability is not that network transmission itself ...[truncated 1354 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove every instruction asking users to paste or otherwise provide an API key to the Agent.
2. Change the missing-key message to require configuration through BROWSERACT_API_KEY or an approved secret manager.
3. Do not accept API credentials through command-line arguments because they may be exposed through process listings and shell history.
4. Ensure application logs and Agent traces redact authorization headers and values resembling API keys.
5. Recommend immediate key rotation if a credential has already been disclosed in a conversation.
6. Use narrowly scoped, short-lived credentials where BrowserAct supports them.
7. Replace the script message with wording such as:

python

print(
    "Set BROWSERACT_API_KEY through your local environment or approved "
    "secret manager. Do not paste API keys into chat.",
    flush=True,
)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/google_maps_search_api.py:49

Finding

Unbounded Polling and Missing HTTP Timeouts Can Cause Indefinite Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/google_maps_search_api.py:49-69
Vulnerability Type: Unbounded network polling and resource exhaustion
Risk Level: Low

Vulnerable Code

python

while True:
    try:
        status_res = requests.get(f"{API_BASE_URL}/get-task-status?task_id={task_id}", headers=headers).json()
        status = status_res.get("status")
        
        timestamp = datetime.datetime.now().strftime("%H:%M:%S")
        print(f"[{timestamp}] Task Status: {status}", flush=True)
        
        if status == "finished":
            print(f"[{timestamp}] Task finished successfully.", flush=True)
            break
        elif status in ["failed", "canceled"]:
            print(f"Error: Task {status}. Please check your BrowserAct dashboard.", flush=True)
            return None
    except Exception as e:
        timestamp = datetime.datetime.now().strftime("%H:%M:%S")
        print(f"[{timestamp}] Polling error: {e}. Retrying...", flush=True)
        
    time.sleep(10)

Related network operations also omit explicit timeouts:

python

res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()

python

task_info = requests.get(f"{API_BASE_URL}/get-task?task_id={task_id}", headers=headers).json()

Technical Analysis

The polling loop has no overall deadline, maximum attempt count, or handling for unknown and permanently nonterminal states. Exceptions are caught and retried indefinitely. Consequently, a task that never reports finished, failed, or canceled keeps the process active without a bound.

In addition, none of the requests.post or requests.get calls specifies a timeout. A stalled connection or server response may therefore block a request for an implementation-dependent and potentially lengthy period. The Skill documentation says that status should be monitored while the operation ...[truncated 1511 chars]

Remediation

View remediation

Remediation Suggestions

1. Set explicit connect and read timeouts on every HTTP request, for example:

python

timeout = (5, 30)
requests.post(url, json=payload, headers=headers, timeout=timeout)
requests.get(url, headers=headers, timeout=timeout)

2. Add an overall polling deadline or a documented maximum number of attempts.
3. Treat missing or unknown status values as bounded errors rather than polling them forever.
4. Use bounded exponential backoff with a maximum delay for transient failures.
5. Catch requests.RequestException and JSON-decoding errors separately so failure reasons can be handled accurately.
6. Return a nonzero exit status when the deadline is exceeded.
7. Support cancellation or interruption so the calling Agent can terminate a task cleanly.
8. Preserve the documented retry limit and ensure it does not restart another unbounded polling cycle.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares environment and network capabilities via metadata but does not define an explicit tool/permission scope. This can let an agent invoke code or outbound requests without clear least-privilege boundaries, increasing the chance of unintended data access or exfiltration. In this skill, that risk is amplified because it uses an API key and performs external data collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The proactive activation text is extremely broad and covers many ordinary business-research requests, which could cause the agent to trigger this skill without sufficiently clear user intent or contextual checks. Because the skill performs automated external collection of business/contact data, over-triggering can lead to unexpected scraping, privacy issues, or terms-of-service violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly supports collecting contact information, lead generation, and CRM export, but it does not warn users about privacy, consent, acceptable use, or compliance obligations. This omission makes it easier to use the skill for mass prospecting or questionable data processing without informed user acknowledgement.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/google_maps_search_api.py (reported line 15)May include surrounding context.

python

# API Configuration
TEMPLATE_ID = "77805072070738748"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_google_maps_search_task(api_key, keywords, language="en", country="us", max_dates=100):
    headers = {"Authorization": f"Bearer {api_key}"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The script sends user-supplied search keywords, locale parameters, and an API bearer token to a third-party service at BrowserAct to execute a remote workflow. This is a real external data transmission and can expose potentially sensitive user queries or business-intelligence targets to an external processor; the risk is heightened because the skill is specifically marketed for lead extraction, competitor tracking, and sales prospecting.

Content

Scanner excerpt · scripts/google_maps_search_api.py (reported line 32)May include surrounding context.

python

# 1. Start Task
    print(f"Start Task", flush=True)
    try:
        res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)
        return None

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation sets default values of en for language and us for country, which can steer execution toward a specific locale when the user has not chosen one. Because the file does not indicate explicit user opt-in for these defaults or justify a region-specific constraint, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.