ClawHub
Back to skill

Security audit

Google Maps Search Api

Security checks for vulnerabilities and agentic risk

Overview

This Google Maps lead-search skill mostly does what it says, but it needs review because it asks users to paste a BrowserAct API key into chat and sends searches through BrowserAct.

Review before installing. Use this only if you are comfortable sending Google Maps search terms, locale settings, and a BrowserAct bearer token to BrowserAct. Configure BROWSERACT_API_KEY through a protected environment variable or secret manager, do not paste the key into chat, and rotate any key that has already been shared in a conversation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Skill Instructs Users to Disclose an API Key Through Chat

Content
View full analysis
"Since you haven't configured the BrowserAct API Key, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations) to get your Key and provide it to me in this chat." ``` `scripts/google_maps_search_api.py:80-83`: ```python print("Please follow these steps:") print("1. Go to: https://www.browseract.com/reception/integrations") print("2. Copy your API Key.") print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).") ``` ### Technical Analysis The Skill explicitly directs users to provide a BrowserAct API key in chat. API keys are authentication secrets and should not be placed in conversation history because chat content may be retained in application logs, model-provider records, debugging traces, transcripts, or other systems that are not intended to act as secret stores. This disclosure is unnecessary for the declared functionality. The script already reads the credential from the `BROWSERACT_API_KEY` environment variable: ```python api_key = os.getenv("BROWSERACT_API_KEY") ``` The script legitimately transmits that key as a Bearer token over HTTPS to the fixed BrowserAct API endpoint. That network transfer is required to authenticate the declared hosted API operation. The insecure behavior is instead the instruction to expose the credential through chat before execution, which exceeds the minimum access necessary for the agent. ### Attack Path 1. A user invokes the Skill without configuring `BROWSERACT_API_KEY` ...[truncated 1301 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to access an environment variable and call an external API, but it does not declare any explicit tool scope or permissions boundary. That increases the risk of overbroad execution in hosts that rely on manifest-declared capabilities, making unintended secret access or network use harder to audit and constrain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description includes broad trigger language such as applying the skill proactively for generic business-search requests. That can cause the agent to invoke the skill without clear user intent, leading to unintended external data transmission or paid API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends user-provided search queries to BrowserAct/Google Maps automation but does not warn users that their queries and related parameters will be transmitted to a third-party service. This creates a privacy and consent risk, especially if users include sensitive business intelligence or personal location-related queries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The hardcoded external API endpoint shows the skill is designed to send data and credentials to a third-party service. This is not inherently malicious and aligns with the skill's purpose, but it increases risk because all operation depends on an external service that receives the API bearer token and user query data, making vendor compromise or misuse a relevant threat.

Content

Scanner excerpt · scripts/google_maps_search_api.py (reported line 9)May include surrounding context.

python
# API Configuration
TEMPLATE_ID = "77805072070738748"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_google_maps_task(api_key, keywords, language="en", country="us", max_dates=100):
    headers = {"Authorization": f"Bearer {api_key}"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The script transmits user-supplied search keywords and locale parameters, along with an authorization token, to a third-party service (BrowserAct). In the context of a business-data extraction skill, this external transmission is functionally necessary, but it still creates privacy and supply-chain risk because user prompts and queries are disclosed to an external processor and there is no visible consent, minimization, or destination validation beyond a hardcoded URL.

Content

Scanner excerpt · scripts/google_maps_search_api.py (reported line 26)May include surrounding context.

python
# 1. Start Task
    try:
        res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}")
        return None

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill defines a language parameter with several supported values but sets the default to en, which may force English output when the user has not requested that locale. The policy allows language constraints only when there is user choice or clear justification, and no such opt-in or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The function signature and payload hard-code default locale values of language="en" and country="us", which imposes a specific language/locale unless the caller overrides them. This is a natural-language policy concern because the script silently assumes an English/US context rather than explicitly asking for or documenting user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a skill for extracting business data from Google Maps search results. While outbound API calls are expected for that purpose, reading credentials from process environment is a separate capability not stated in the manifest and is not intrinsic to business-data extraction itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.