Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do what it says: connect OpenClaw to Geomanic travel data, including reading and changing sensitive location records.
Install this only if you want OpenClaw to access your Geomanic GPS history. Treat GEOMANIC_TOKEN like a password, avoid exposing raw location results unnecessarily, and confirm the exact waypoint and intended change before create, update, or delete actions.
The markdown file lists a delete_waypoint tool with no accompanying warning about deletion impact, confirmation expectations, or recoverability. Because waypoint deletion can affect user data and system integrity, the skill description should explicitly disclose that this operation removes stored data and whether it can be undone.
The skill instructs the agent to send a bearer token and highly sensitive GPS/location data to a remote service without an explicit privacy notice or data-sharing warning. Because travel history can reveal home/work patterns and movements, omission of clear disclosure and consent guidance creates a meaningful privacy and credential-handling risk.
This skill explicitly directs use of curl to POST data to an external endpoint with an Authorization bearer token, which is a genuine external transmission path. In context this is expected functionality, but it still creates security exposure because secrets and sensitive waypoint/travel data leave the local environment and may be sent in response to unsafe prompts if the agent lacks guardrails.
Use curl via the exec tool to send JSON-RPC requests to https://geomanic.com/api/v1/mcp:
curl -s -X POST https://geomanic.com/api/v1/mcp \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $GEOMANIC_TOKEN" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'
The skill exposes mutation and deletion operations for waypoint data but provides no guidance to require explicit user confirmation before creating, modifying, or deleting records. In an agent setting, this increases the risk of accidental or prompt-induced destructive actions against sensitive travel history, especially because location records are difficult to reconstruct once altered or removed.
No suspicious patterns detected.