{"data":{"skill":{"slug":"locusintelligence-dauagency-not-showing-on-maps","name":"not-showing-on-maps","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/not-showing-on-maps","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"20f6e963-2341-494c-85b7-5c7c4becce0f","skill_id":"f3a82a2c-0254-423d-8326-8591902f0782","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:7afff4ea2f29fd7decd943daf78fb936d2fdd224c3c4c014f2f771738c043d79:71d5831fc7f21706e416ac00a77c573d840be657640e3c85de731d5e7faffdb5:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f6e6f742d73686f77696e672d6f6e2d6d617073:eedbcb207b7fca2e2257f23e2a2a06f8","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 23 static findings are false positives: Markdown formatting, privacy guidance, business ranking checks, and disclosed Reach service URLs. The skill restricts diagnosis to account-scoped reads, rejects tool-result instructions, and requires confirmation before sending feature requests. No evidence found of credential exfiltration, shell execution, system reconnaissance, or prompt injection; the hosted server implementation is outside this review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":54}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":42}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":77,"audit_model":"codex","audited_at":"2026-10-10T22:59:07.863+00:00","created_at":"2026-10-11T03:54:08.703139+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Connection.** Call `get_account`. Read `connection` for the location: `connectionStatus` (`acti","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Profile.** Call `get_listing` with `sections: [\"profile\"]`. Check `googleSynced`, `mapsUrl` (em","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Rankings.** Call `get_visibility` with `sections: [\"summary\", \"grid\"]`. Note tracked keywords w","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Traffic.** Call `get_performance` for the last 28 days and the 28 before. Look for a drop in im","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. No Maps page or listing not synced (`mapsUrl` empty, `googleSynced` false). Free [Maps checker](h","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Missing or weak primary category, or no additional categories. Hand off to `categories-and-servic","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Service-area business with no or wrong service area, or a missing address or hours. Hand off to `","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. Thin profile: no description, services, photos or website. Hand off to `optimize-google-business-","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. Ranks poorly or not at all for searches, or empty grid points. Hand off to `local-rank-audit`; fr","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop on a location whose `connectionStatus` is not `active`.","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data; relay each message and its link.","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `listing_only`, relay the message and `connectUrl`, and stop.","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the owner asks for something Reach cannot do (reading verification state, contacting Google), o","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"network:SKILL.md:24:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:37:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2. Verification. Reach does not return verification state. Ask the owner whether Google shows \"Verif","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"3. No Maps page or listing not synced (`mapsUrl` empty, `googleSynced` false). Free [Maps checker](h","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:42:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"7. Ranks poorly or not at all for searches, or empty grid points. Hand off to `local-rank-audit`; fr","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Read-only diagnosis of why a business is not showing on Google Maps or Search, for a Go","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:30:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. **Rankings.** Call `get_visibility` with `sections: [\"summary\", \"grid\"]`. Note tracked keywords w","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"blocker:SKILL.md:42:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"7. Ranks poorly or not at all for searches, or empty grid points. Hand off to `local-rank-audit`; fr","category":"blocker","line_end":42,"severity":"low","line_start":42}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented MCP server URL in Markdown. There is no shell or Ruby execution expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Backticks mark the get_account tool name, connection fields, and status values. The workflow reads account connection state, not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Backticks format get_listing arguments and profile field names. This is an account-scoped profile read with no command execution syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The inline code describes get_visibility and its summary and grid sections. It requests business ranking data, not an executable shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Markdown backticks identify get_performance and limitations. Comparing two reporting periods does not execute shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks label mapsUrl and googleSynced fields in a diagnostic checklist. The accompanying Maps checker is a reference link, not shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticked text names the categories-and-service-area skill for a suggested handoff. It contains no shell invocation or executable expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Inline code marks names of related profile improvement skills. The instruction recommends a handoff rather than executing external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks format the optimize-google-business-profile skill name. This is a recommendation for another workflow, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Markdown inline code names local-rank-audit, followed by a reference link. Neither is a shell or Ruby command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Backticks label connectionStatus and active in a stopping condition. This guard limits access when the connection is inactive.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks identify a limitations field for reporting data availability. There is no instruction to execute its contents as shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Inline code labels listing_only and connectUrl in a stop-and-report condition. It does not execute commands or automatically follow the returned URL.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Backticks identify request_feature, an MCP tool rather than a shell command. Sending requires owner confirmation and excludes private customer details.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:python-http-libraries","reason":"This line is privacy guidance, not Python imports or HTTP library calls. It explicitly forbids reading local secrets or disclosing credentials.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The HTTPS URL is the explicitly required Reach MCP endpoint, with browser OAuth described nearby. No evidence found of unrelated data transmission or credential exfiltration.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:16:hardcoded-url","reason":"This HTTPS link points to Reach client setup documentation on the same disclosed service domain. No sensitive payload or automatic upload is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:37:hardcoded-url","reason":"The verification guide is a relevant reference because Reach cannot return verification status. The URL contains no credentials or customer data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"The Maps checker link supports the stated visibility diagnosis on the disclosed Reach domain. No instruction sends private fields to this URL.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:42:hardcoded-url","reason":"The local finder checker is a task-relevant reference link. There is no encoded payload, credential parameter, or unrelated network destination.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The description concerns business listing visibility, local ranking grids, and impressions. It does not request host inspection or system reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:30:system-reconnaissance","reason":"The grid contains local business search ranking results for tracked keywords. It does not describe network probing, host enumeration, or environment inspection.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:42:system-reconnaissance","reason":"The checklist discusses poor business search rankings and missing geographic grid results. The recommended local rank audit is not system reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"7afff4ea2f29fd7decd943daf78fb936d2fdd224c3c4c014f2f771738c043d79","subject_tree_hash":"71d5831fc7f21706e416ac00a77c573d840be657640e3c85de731d5e7faffdb5","subject_plugin_path":"skills/locusintelligence-dauagency/not-showing-on-maps","audit_payload_hash":"eedbcb207b7fca2e2257f23e2a2a06f8","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"7afff4ea2f29fd7decd943daf78fb936d2fdd224c3c4c014f2f771738c043d79","treeHash":"71d5831fc7f21706e416ac00a77c573d840be657640e3c85de731d5e7faffdb5","pluginPath":"skills/locusintelligence-dauagency/not-showing-on-maps","auditPayloadHash":"eedbcb207b7fca2e2257f23e2a2a06f8"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-not-showing-on-maps/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}