ClawHub
Back to skill

Security audit

Goplaces

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wrapper for a Google Places CLI, with the main caveat that it installs an unpinned third-party Homebrew package.

Before installing, confirm you trust the steipete/tap Homebrew source and the goplaces project, avoid running installation with elevated privileges, and use a Google Places API key scoped and quota-limited for this use case.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Homebrew Tap Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-12
Vulnerability Type: Unpinned dependency from a third-party Homebrew tap
Risk Level: Medium

Vulnerable Code

yaml
metadata: {"clawdbot":{"emoji":"📍","requires":{"bins":["goplaces"],"env":["GOOGLE_PLACES_API_KEY"]},"primaryEnv":"GOOGLE_PLACES_API_KEY","install":[{"id":"brew","kind":"brew","formula":"steipete/tap/goplaces","bins":["goplaces"],"label":"Install goplaces (brew)"}]}}
markdown
Install
- Homebrew: `brew install steipete/tap/goplaces`

Technical Analysis

The skill directs users or automated skill managers to install goplaces from the external Homebrew tap steipete/tap without pinning an immutable version, commit, artifact digest, or cryptographic checksum. Consequently, the software installed at a later date can differ from the software that was reviewed.

Homebrew formula installation can execute formula-defined build and installation logic and place executable files on the user's command path. If the tap repository, its maintainer account, release artifacts, or associated build infrastructure were compromised, an attacker could publish a malicious formula or replacement binary under the expected package name.

The project contents do not establish that the current tap or package is malicious. The confirmed weakness is the absence of dependency immutability and integrity verification, which leaves installation security dependent on mutable third-party infrastructure.

Attack Path

  1. An attacker compromises the third-party tap, its maintainer credentials, or an artifact distribution source referenced by its formula.
  2. The attacker modifies the goplaces formula or replaces a referenced release artifact with a malicious version.
  3. A user or automated skill installer executes brew install steipete/tap/goplaces as directed by SKILL.md.
  4. Homebrew retrieves and processes the attacker-controlled formula o ...[truncated 930 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed, immutable release rather than installing the latest state of a mutable tap.
  • Verify downloaded artifacts with a trusted SHA-256 checksum or cryptographic signature before installation.
  • Where supported, pin the tap itself to a reviewed commit and document the exact expected formula and package version.
  • Prefer a trusted package source with reproducible builds, provenance attestations, and signed releases.
  • Review both the Homebrew formula and its referenced source or binary artifacts before approving updates.
  • Perform dependency updates through a controlled review process instead of automatically tracking upstream changes.
  • Run installation and subsequent CLI execution without elevated privileges and in a restricted environment.
  • Provide GOOGLE_PLACES_API_KEY only to the process that requires it, use a key restricted to the necessary API and quota, and rotate it if package compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.