google-maps-scraper
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install standard Node.js dependencies (such as
typescript,bottleneck, andexpress) from public registries and makes network requests to the RapidAPI service domain (maps-data.p.rapidapi.com). - [DATA_EXPOSURE]: The skill provides instructions for managing sensitive API keys using environment variables or
.envfiles, aligning with secure development best practices for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill identifies potential attack surfaces where untrusted data enters the agent's context during processing.
- Ingestion points: Search queries and location strings are accepted via CLI arguments in
src/index.tsand web form inputs insrc/server.ts; business data is retrieved from the RapidAPI response insrc/client.ts. - Boundary markers: Absent. The skill does not explicitly use delimiters to separate external data from system instructions.
- Capability inventory: The skill has capabilities to write to the local file system (
src/csv.ts) and perform network requests (src/client.ts). - Sanitization: Business data is escaped for CSV formatting in
src/csv.tsto prevent CSV injection, though no specific sanitization for LLM-based indirect injection is present.
Audit Metadata