mapbox-token-security

skills-sh:mapbox_mapbox-agent-skills__mapbox-token-security

View source
B
85/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

1

Score

85/100

HIGH 1

Findings (1)

HIGH
Private data read with public output
L34

Skill can read private data (credentials, SSH keys, env vars) AND write to public channels (Slack, Discord, email). This combination enables data exfiltration.

[reads_private_data] access

### Secret + [writes_public_output] Share via email or Slack
FIX

Break the toxic data flow by adding validation and sanitization between the input source and the sensitive operation. Do not pass untrusted data directly to file system, network, or execution APIs.

FP?

Likely FP if the data flow involves only trusted, hardcoded values and the taint analysis over-approximated the untrusted input sources.