Security audit

Openstreet Map

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it geocodes places and renders OpenStreetMap images, with some operational risks but no evidence of hidden or malicious behavior.

Install this only in an environment where network calls to OpenStreetMap/Nominatim and writing requested output images are acceptable. Prefer a virtual environment, pin dependencies if deploying seriously, avoid feeding untrusted or very large point sets, and keep width, height, base64 output, and request frequency under operator control.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: tools/openstreet_skill.py:374
Finding: Unbounded Rendering Inputs Allow Resource Exhaustion
Content: View full analysis
int: if args.points_base64: decoded = base64.b64decode(args.points_base64).decode("utf-8") data = json.loads(decoded) elif args.points_file: data = json.loads(Path(args.points_file).read_text(encoding="utf-8")) else: raise ValueError("One of --points-file or --points-base64 is required") if not isinstance(data, lis ...[truncated 2788 chars]
Remediation: View remediation
MAX_PIXELS: raise ValueError("Requested image exceeds the maximum pixel count") if len(data) > MAX_POINTS: raise ValueError(f"At most {MAX_POINTS} points are allowed") ``` ]]>

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependencies Are Installed Without Reproducible Version or Integrity Pinning
Content: View full analysis
=10.0.0 requests>=2.31.0 ``` `SKILL.md`: ```bash pip install -r requirements.txt ``` ### Technical Analysis The requirements specify only minimum versions and do not impose upper bounds, exact versions, or package hashes. Consequently, installation results can change over time and may include dependency versions that were not reviewed with this project. The package names observed in the project are legitimate; there is no evidence of typosquatting, dependency confusion, a malicious package, or an unsafe package index. The risk arises from allowing future, unaudited releases to be selected without integrity verification or a lock file. Python packages and their transitive dependencies execute code within the installation or runtime environment. If a future matching release or transitive dependency is compromised, the installation command could introduce attacker-controlled code with the permissions of the user performing the installation. ### Attack Path 1. A user follows the documented installation command. 2. `pip` resolves the latest versions satisfying the open-ended lower bounds. 3. A future release or transitive dependency that was not audited is downloaded without project-provided hash verification. 4. If that release has been compromised, malicious package code may execute during installation or when the skill imports the dependency. 5. The code operates with the permissions of the installing user or skill runtime. This is a supply-chain exposure rather than evidence that the currently named packages are malicious. ### Impact Assessment The maximum impact depends on the privileges used for installation and execution. A compromised dependency could potentially: - Execute arbitrary Python code as the inst ...[truncated 353 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: openstreet-map version: 1.0.0 description: "Use when you need OpenStreetMap geocoding or annotated map generation for a set of places." --- # OpenStreet Map Skill (for OpenClaw) This skill provides two capabilities: 1. Query one place's location information. 2. Render an annotated map image for multiple places with numbered markers and a legend. ## Prerequisites - Python 3.10+ - Internet access (Nominatim + OSM tile endpoints) Optional environment variable: - `OPENSTREET_MAP_HOST`: Override only the `openstreetmap.org` host suffix in the default endpoints. Recommended form: `openstreetmap.org`. If `http://` or `http

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill manifest does not declare any explicit tool scope or permissions even though the skill clearly requires environment-variable access, file input/output, and outbound network access. In an agent ecosystem, missing scope declarations can lead to overbroad execution, weak reviewability, and accidental authorization of capabilities the operator did not intend to grant.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The OPENSTREET_MAP_HOST environment variable can redirect both geocoding and tile fetches to an arbitrary host, enabling outbound requests to infrastructure unrelated to OpenStreetMap. In an agent/tooling environment, this creates an SSRF-like primitive and breaks the skill’s stated trust boundary of using OSM services only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill sends user-provided location queries to an external geocoding endpoint and later downloads map tiles from external servers, but there is no confirmation prompt or user-facing disclosure that place names, addresses, or map coordinates will be transmitted over the network. Because these requests may expose user location-related data to third-party services, the code should make that behavior explicit.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or incompatible releases through normal dependency resolution or supply-chain compromise.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
Pillow>=10.0.0 requests>=2.31.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: Pillow has multiple historical advisories, including issues such as resource exhaustion and possible code-execution-class bugs in some versions. Because the manifest does not pin the package, it is impossible to verify whether deployments will avoid affected versions, which is more concerning here because the skill generates annotated maps and likely processes image data.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The requests package is also unpinned, so installations are not reproducible and may pull in unexpected future releases. In a network-facing skill that performs geocoding, this increases supply-chain risk because a compromised or vulnerable upstream version could be introduced without code changes.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
Pillow>=10.0.0 requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: Requests has known advisories affecting certain versions, and the unpinned specification prevents verification that installed versions are patched. Since this skill likely makes outbound HTTP requests for OpenStreetMap geocoding, using an affected version could expose credential leakage, TLS/session handling flaws, or other client-side request issues depending on runtime behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The docstring says the function resolves endpoints from an environment variable override, implying the override will change the service URLs. However, the implementation calls replace("openstreetmap.de", replacement_host) on defaults that contain "openstreetmap.org", so the override does not actually affect the returned URLs. This is an active contradiction between documentation and behavior, not merely missing detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The legend title contains fixed Chinese text ("图例 / Legend") embedded in the output, which imposes a locale-specific presentation choice without any user option to select or disable it. The policy requires avoiding forced language or locale behavior unless the user is given a choice or the constraint is clearly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The code creates parent directories and saves a PNG file to disk, but it does not print a warning or confirmation before performing the write. Although file output is part of rendering functionality, the actual write behavior and directory creation are not separately disclosed at runtime.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.