Security audit

Local Places

Security checks across malware telemetry and agentic risk

Overview

The skill largely does what it promises, but it needs review because some bundled server instructions can expose an unauthenticated Google Places proxy and its API-key-backed usage beyond localhost.

Install only if you are comfortable sending place and location queries to Google Places. Run the server bound to 127.0.0.1, not 0.0.0.0, unless you intentionally want LAN exposure and have added access controls. Keep GOOGLE_PLACES_BASE_URL unset or verify it points to a trusted endpoint, protect the Google API key, and consider removing raw request-body logging before regular use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires access to an environment variable containing a Google API key and performs network operations, but the skill metadata does not explicitly declare those permissions. This reduces transparency for reviewers and users, making it easier to overlook sensitive capability use and increasing the chance of unsafe deployment or unintended data/API-key exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is described as using a localhost proxy for place search, but the behavior also includes location resolution, place details retrieval, and apparent direct contact with the external Google Places API. This mismatch can mislead users and operators about where data goes and what actions the skill performs, undermining informed consent and security review.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly instructs users to send free-text place queries and user-provided location strings through a localhost proxy to the Google Places API, but it provides no warning that this data may be transmitted to Google or governed by third-party terms and privacy practices. In a skill designed to process natural-language queries, users may include sensitive addresses, routines, or personally identifying location information, so the lack of disclosure creates a real privacy risk and can lead to unintentional data sharing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill does not warn users that their location queries and possibly sensitive place-search context may be transmitted through a proxy to Google services. Because location data is privacy-sensitive, omission of this disclosure increases the risk of users sharing personal whereabouts without understanding the external data flow.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The validation exception handler logs the full request body and detailed validation errors for every malformed request. If clients submit sensitive data such as location queries, identifiers, API-related values, or user-supplied content, that data will be persisted in logs and may be exposed to operators, log aggregators, or anyone with log access.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.