Trust Assessment
google-maps-search-api received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Suspicious import: requests, Potential Command Injection via Unsanitized User Input in Skill Execution Example.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via Unsanitized User Input in Skill Execution Example The `SKILL.md` provides an example of how the agent should execute the `google_maps_search_api.py` script using a shell command. If the agent directly substitutes user-provided input (e.g., for `KeyWords`, `language`, `country`, `max_dates`) into this command string without proper shell escaping or sanitization, a malicious user could inject arbitrary shell commands. Although `KeyWords` is shown quoted in the example, the responsibility for robust escaping lies with the agent's implementation, which is not explicitly enforced or warned about in the skill definition. This could lead to arbitrary code execution on the host system. The skill documentation should explicitly warn the agent about the critical need to sanitize and shell-escape all user-provided parameters before constructing and executing the command. Alternatively, if the agent environment supports it, prefer passing parameters via a more secure mechanism (e.g., a dedicated function call with typed arguments) rather than raw shell command substitution. | LLM | SKILL.md:60 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/phheng/google-maps-search-api/scripts/google_maps_search_api.py:3 |
Scan History
Embed Code
[](https://skillshield.io/report/49ccd7ee7837d2d5)
Powered by SkillShield