The Agent Skills Directory

[Remote Code Execution] (CRITICAL): The skill provides installation instructions that pipe a remote script from https://canifi.com/skills/google-maps/install.sh directly into bash. This allows the remote server to execute arbitrary commands on the user's host machine with full shell privileges.
[Remote Code Execution] (CRITICAL): The setup process requires another untrusted remote script execution via curl -sSL https://canifi.com/install.sh | bash to install the canifi-env tool.
[Command Execution] (HIGH): The skill relies on unverified external CLI tools (canifi-env) for configuration. Because these tools are installed via the aforementioned RCE vectors, their integrity and the commands they execute cannot be trusted.
[Credentials Unsafe] (HIGH): The documentation explicitly instructs users to store sensitive information, including SERVICE_PASSWORD, in local environment variables. Since the environment is managed by untrusted scripts, these credentials are vulnerable to exfiltration.

google-maps