ClawHub
Back to skill

Security audit

Google Maps

Security checks for vulnerabilities and agentic risk

Overview

This Google Maps skill mostly does what it advertises, but it can print your Google API key inside returned place photo URLs.

Review before installing. Use a Google API key restricted to only the required Maps APIs, with quota and billing limits, and rotate it if this skill has already printed search/details results containing photo_url fields. Avoid sensitive home, work, medical, legal, or client locations unless you are comfortable sending them to Google. The publisher should fix the skill so it never returns API keys in URLs and should add clearer privacy disclosure for location data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
lib/map_helper.py:259
Finding

Google Maps API Key Disclosed in Returned Photo URLs

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:20
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Forward geocoding sends user-supplied addresses to Google, which can disclose sensitive location information to a third party without any explicit notice or consent flow in the skill path. In a mapping skill this data transfer is expected, but the absence of disclosure still creates a real privacy risk because addresses may reveal home, work, or other sensitive places.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Reverse geocoding transmits precise latitude/longitude, which is highly sensitive and can identify exact user whereabouts. Without explicit disclosure or consent, the skill may expose precise location data to an external provider in ways users do not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Place search sends free-text queries plus optional location context to Google, which can reveal user interests, habits, and nearby position. In-context this is core functionality, but the lack of disclosure means users may unknowingly share sensitive contextual data with a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/map_helper.py (reported line 407)May include surrounding context.

python
"X-Goog-FieldMask": "routes.duration,routes.staticDuration,routes.distanceMeters,routes.legs.startLocation,routes.legs.endLocation"
        }
        
        response = requests.post(url, headers=headers, json=request_body)
        
        if response.status_code != 200:
            return {"error": f"API error: {response.status_code}", "details": response.text}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/map_helper.py (reported line 566)May include surrounding context.

python
"X-Goog-FieldMask": "routes.duration,routes.staticDuration,routes.distanceMeters,routes.legs.startLocation,routes.legs.endLocation"
        }
        
        response = requests.post(url, headers=headers, json=request_body)
        
        if response.status_code != 200:
            return {"error": f"API error: {response.status_code}", "details": response.text}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · lib/map_helper.py (reported line 726)May include surrounding context.

python
"X-Goog-FieldMask": "routes.duration,routes.staticDuration,routes.distanceMeters,routes.legs.startLocation,routes.legs.endLocation"
        }
        
        response = requests.post(url, headers=headers, json=request_body)
        
        if response.status_code != 200:
            return {"error": f"API error: {response.status_code}", "details": response.text}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Route computation sends origin, destination, timing, and routing preferences to Google, which can expose travel plans and sensitive personal patterns. Because this skill is specifically built for navigation, the transmission is contextually expected, but lack of clear disclosure and consent still makes it a genuine privacy weakness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Detailed directions requests may include origin, destination, waypoints, departure/arrival times, and transit details, creating an even richer picture of a user's movements and intent. This makes the privacy concern stronger than basic lookups if users are not clearly informed that this data is sent off-platform to Google.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Route matrix requests can transmit multiple origins and destinations in one call, potentially exposing a broader set of locations such as offices, homes, clients, or planned stops. The bulk nature of the request increases privacy sensitivity, and the code offers no user-facing notice before sending this data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

Place details sends a place identifier to Google; this is less sensitive than raw coordinates or free-text addresses, but it still discloses what place the user is interested in. The privacy impact is lower, yet a disclosure gap remains.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest advertises distance/travel-time calculations with traffic prediction and avoid options, and the module documentation presents matrix support as part of the Routes API feature set. In the matrix method, departure_time is parsed and then explicitly discarded, and avoid is accepted in the signature but never used, so the implemented behavior falls short of the described capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The help text shows matrix ... [options], which in context suggests the same option style described above, including departure time and avoid settings. However, the matrix implementation does not apply avoid at all and deliberately ignores parsed departure_time, so the documentation overstates what the command actually does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.