google-maps

The local module is a minimal CLI that forwards user-supplied place IDs to a remote agent service authenticated by a one-key token. The main risks are supply-chain trust in ai_agent_marketplace, the presence of a hardcoded default access key in source, lack of input validation, and unredacted logging of remote responses. These create a meaningful risk of information exposure or misuse if the dependency or the default token is compromised. Recommendations: remove the hardcoded fallback credential (require explicit env/config), audit the ai_agent_marketplace package and its network endpoints, add validation/size limits on place_id, and redact or gate printing of sensitive fields. Also fix the syntactic issue at the script end if present.

The skill presents a coherent implementation for accessing Google Maps APIs through a unified OneKey Router with a clearly defined set of tools and parameters. The main security considerations are the use of an environment-provided API key with a demo key fallback, and the involvement of an external intermediary (OneKey Router) to reach Google services. While this aligns with the stated purpose, there is moderate risk around credential handling and potential data exposure through logs or demos. Documentation should clearly instruct secure handling of API keys, avoid exposing demo keys, and detail input validation and auditing. Overall, the footprint is proportionate to the described functionality, but the credential management and external routing introduce non-trivial risk that should be mitigated with proper secret handling and access controls.