📦

geo-sleuth

Name: geo-sleuth
Author: oldcircle

Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff⚙️ Externe Befehle🔑 Umgebungsvariablen📁 Dateisystemzugriff⚡ Enthält Skripte

Investigate Photo Locations With Verified Evidence

Photo locations are difficult to establish when metadata is missing or visual clues are ambiguous. Geo-sleuth compares candidates using image analysis, maps, and geometric checks, then reports evidence and uncertainty.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "geo-sleuth" from https://skillstore.io/skills/oldcircle-geo-sleuth.md and its manifest at https://skillstore.io/api/skills/oldcircle-geo-sleuth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/oldcircle-geo-sleuth.md Signiertes manifest GET /api/skills/oldcircle-geo-sleuth/manifest Signiertes lockfile GET /api/skills/oldcircle-geo-sleuth/lockfile

Testen

„geo-sleuth“ wird verwendet. Illustrative request: inspect an owned travel photo locally without external uploads.

Erwartetes Ergebnis:

Illustrative result: no usable GPS metadata was available.
A partially readable sign provides a location hypothesis, not a verified conclusion.
Reverse image search was skipped because uploads were not authorized.
Next evidence needed: a clearer sign crop or a known landmark.

„geo-sleuth“ wird verwendet. Illustrative request: compare two public-landmark candidates using reference imagery.

Erwartetes Ergebnis:

Illustrative result: Candidate A remains the stronger area-level hypothesis.
Its reference imagery agrees with the landmark outline and nearby road layout.
Candidate B remains an alternative because its relevant frontage was not checked.
Camera coordinates and capture time remain unresolved.

„geo-sleuth“ wird verwendet. Illustrative request: evaluate morning versus evening capture at a verified public location.

Erwartetes Ergebnis:

Illustrative result: shadow direction supports the morning hypothesis under the supplied date assumption.
The date remains uncertain, so the capture-time range is conditional.
A second shadow measurement would help test the result.

Sicherheitsaudit

Hohes Risiko

v1 • 11.10.2026 Versionsbericht öffnen

Most static matches are false positives from Python identifiers, documentation, lookup tables, tests, and standard model operations. Confirmed risks include curl option injection, unvalidated thumbnail destinations, photo uploads without explicit consent, and inadequate safeguards for precise private-location identification. The static catalog covers 400 of 486 matches; 86 omitted matches still require manual review before automatic publication. Static review was capped at 400/486 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

44,220

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:40-47 scripts/intake.py:130-132 scripts/intake.py:194-209 scripts/revimg.py:148-154 scripts/revimg.py:195-201

Photo Uploads Lack Explicit Consent

Default intake uploads the original photo and generated variants to Baidu and Yandex. No explicit upload consent or mandatory redaction step protects private image content.

The default engines and file-upload calls directly establish third-party transmission. Uploads can be disabled, but the documented first command does not require informed consent.

Hoch

SKILL.md:24 SKILL.md:131-148

Private-Location Precision Has Inadequate Safeguards

The privacy rule says to 'go to the finest level as usual' when a source or purpose is already stated. This exception can expose residences or locations associated with minors without establishing authorization.

The explicit exception bypasses the purpose question for sensitive images, while the output requirements support coordinates and building or floor precision. Harmful intent is not established.

Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/_net.py:26

Python subprocess.run

result = subprocess.run(cmd + [url], capture_output=True, timeout=timeout + 5)

Remote thumbnail values reach curl arguments without URL validation or '--'. Option-shaped input can load curl configuration files; argument lists prevent shell injection, not option injection.

Mittel

scripts/revimg.py:104

Hardcoded URL

data = fetch_bytes(url, proxy, 15, {"User-Agent": UA, "Referer": "https://graph.baidu.com/"})

The download URL comes from remote thumbUrl fields, not the fixed Referer header. Unrestricted destinations and redirects can trigger requests to internal services.

Risikofaktoren

🌐 Netzwerkzugriff (50)

data/calling_codes.json:4 data/driving_side.json:4 data/territories.json:4 regions/cn/data/admin.json:4 regions/cn/data/area_codes.json:11 regions/cn/data/plates.json:13 regions/README.md:63 scripts/_browser.py:12 scripts/_net.py:35 scripts/_net.py:36 scripts/_net.py:39 scripts/baidu_pano.py:40 scripts/doctor.py:35 scripts/doctor.py:36 scripts/doctor.py:37 scripts/doctor.py:38 scripts/doctor.py:39 scripts/doctor.py:40 scripts/doctor.py:41 scripts/doctor.py:46 scripts/evidence.py:10 scripts/gsv.py:39 scripts/gsv.py:40 scripts/gsv.py:36 scripts/osm.py:58 scripts/osm.py:59 scripts/osm.py:60 scripts/osm.py:63 scripts/poi.py:59 scripts/poi.py:82 scripts/poi.py:95 scripts/refresh.py:35 scripts/refresh.py:36 scripts/refresh.py:37 scripts/refresh.py:38 scripts/refresh.py:39 scripts/refresh.py:40 scripts/revimg.py:102 scripts/revimg.py:53 scripts/revimg.py:54 scripts/revimg.py:104 scripts/revimg.py:148 scripts/revimg.py:195 scripts/terrain.py:60 scripts/tiles.py:54 scripts/tiles.py:265 scripts/tiles.py:295 scripts/tiles.py:40 scripts/tiles.py:41 SKILL.md:157

⚙️ Externe Befehle (50)

regions/cn/region.json:22 regions/cn/region.json:23 scripts/_browser.py:25 scripts/_browser.py:26 scripts/_net.py:26 scripts/board.py:126 scripts/board.py:9 scripts/board.py:80 scripts/board.py:81 scripts/board.py:83 scripts/board.py:84 scripts/board.py:100 scripts/board.py:244 scripts/board.py:245 scripts/board.py:484 scripts/board.py:494 scripts/board.py:518 scripts/board.py:578 scripts/board.py:611 scripts/board.py:628 scripts/board.py:629 scripts/board.py:630 scripts/board.py:631 scripts/board.py:653 scripts/board.py:655 scripts/board.py:657 scripts/board.py:658 scripts/board.py:665 scripts/board.py:678 scripts/board.py:766 scripts/board.py:767 scripts/board.py:768 scripts/board.py:1068 scripts/board.py:1170 scripts/clues.py:10 scripts/clues.py:11 scripts/clues.py:12 scripts/clues.py:16 scripts/clues.py:73 scripts/clues.py:196 scripts/clues.py:234 scripts/doctor.py:58 scripts/doctor.py:78 scripts/doctor.py:119 scripts/doctor.py:110 scripts/doctor.py:149 scripts/gsv.py:52 scripts/imgprep.py:14 scripts/intake.py:52 scripts/intake.py:223

🔑 Umgebungsvariablen (38)

📁 Dateisystemzugriff (37)

scripts/board.py:657 scripts/doctor.py:26 scripts/doctor.py:126 scripts/evidence.py:52 scripts/geo.py:522 scripts/geo.py:747 scripts/geo.py:948 scripts/geo.py:953 scripts/geo.py:955 scripts/geo.py:1005 scripts/geo.py:1034 scripts/geo.py:1050 scripts/intake.py:296 scripts/match.py:26 scripts/match.py:26 scripts/match.py:212 scripts/match.py:323 scripts/osm.py:532 scripts/pose.py:196 scripts/regions.py:347 scripts/revimg.py:64 scripts/revimg.py:323 scripts/revimg.py:326 scripts/tiles.py:120 tests/test_board.py:13 tests/test_board.py:23 tests/test_board.py:137 tests/test_regions.py:14 tests/test_regions.py:91 tests/test_runtime.py:17 tests/test_runtime.py:102 tests/test_runtime.py:152 tests/test_runtime.py:167 tests/test_runtime.py:193 tests/test_terrain.py:15 tests/test_terrain.py:75 tests/test_terrain.py:162

⚡ Enthält Skripte (2)

scripts/match.py:99 scripts/sat_scan.py:128

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/oldcircle-geo-sleuth/security.svg)](https://skillstore.io/skills/oldcircle-geo-sleuth?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/oldcircle-geo-sleuth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oldcircle-geo-sleuth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/oldcircle-geo-sleuth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

oldcircle. (2026). geo-sleuth security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1

BibTeX-Zitat

@techreport{oldcircle-oldcircle-geo-sleuth-2026,
  author = {oldcircle},
  title = {geo-sleuth security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "geo-sleuth security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "oldcircle"
date-released: "2026-10-11"
url: "https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1"
identifiers:
  - type: other
    value: "skillstore:oldcircle-geo-sleuth:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Verify Public-Scene Images

Compare a licensed public-scene photo with map and reference imagery, recording supporting evidence and unresolved location alternatives.

Organize Personal Photo Archives

Investigate locations and possible capture times for your own travel photos, starting locally and approving any external uploads.

Evaluate Geolocation Puzzles

Test authorized public-landmark puzzles using ranked candidates, explicit exclusions, comparison images, and uncertainty reports.

Diese Prompts ausprobieren

Inspect a Photo Locally

Inspect my travel photo at [photo path] using intake with --no-rev. Summarize metadata, readable text, visible clues, and missing information. Do not upload it.

Compare Location Candidates

Compare [candidate places] for my public-landmark photo at [photo path]. Record clues on the candidate board and check them against maps. Ask before image uploads.

Estimate a Capture-Time Range

For my photo at [photo path], use [verified public location] and [possible dates] to evaluate sun and shadow constraints. Report assumptions and feasible time ranges.

Verify an Authorized Location Hypothesis

Investigate this authorized public-landmark puzzle at [photo path] within [search bounds] and [time budget]. Rank satellite cells and street-view candidates. Check geometry and produce evidence, alternatives, and uncertainty. Ask before image uploads.

Bewährte Praktiken

Use owned or authorized public-scene photos, start with --no-rev, and approve external uploads only after reviewing privacy implications.
Record each clue and actual output file, then verify precision with independent constraints or stable ground-level features.
Set a search budget and report alternatives, coverage gaps, unresolved clues, and uncertainty.

Vermeiden

Uploading sensitive photos without informed permission or using the workflow to identify private individuals or residences.
Treating similarity scores, editable metadata, or posting times as verified location or capture-time evidence.
Reporting exact coordinates or excluding candidates without sufficient checks and real evidence files.

Häufig gestellte Fragen

Which assistants can use this skill?

The skill supports Claude, Codex, and Claude Code. Shell access and the documented runtime dependencies are required for script execution.

Does the skill upload my photo?

Default intake uploads original photos and variants to Baidu and Yandex. Use --no-rev to skip image uploads; other selected routes may still use network services.

Can it always identify an exact location?

No. Results depend on clues and reference coverage. The workflow can report a supported region, alternatives, or missing evidence instead of exact coordinates.

Can it determine when a photo was taken?

It can evaluate metadata and sun or shadow constraints. Without reliable dates, location, and measurements, capture-time estimates remain conditional.

What setup does it require?

Use Python 3.10+, uv, and curl. Reverse search needs Chrome or Playwright Chromium; image-ranking routes download model weights and install additional dependencies.

What remains unresolved in the security review?

Curl argument handling, thumbnail destination checks, upload consent, and private-location safeguards need improvement. Another 86 static matches require manual review.