스킬 geo-sleuth

📦

geo-sleuth

Name: geo-sleuth
Author: oldcircle

콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚙️ 외부 명령어🔑 환경 변수📁 파일 시스템 접근⚡ 스크립트 포함

Investigate Photo Locations With Verified Evidence

Photo locations are difficult to establish when metadata is missing or visual clues are ambiguous. Geo-sleuth compares candidates using image analysis, maps, and geometric checks, then reports evidence and uncertainty.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "geo-sleuth" from https://skillstore.io/skills/oldcircle-geo-sleuth.md and its manifest at https://skillstore.io/api/skills/oldcircle-geo-sleuth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/oldcircle-geo-sleuth.md 서명된 manifest GET /api/skills/oldcircle-geo-sleuth/manifest 서명된 lockfile GET /api/skills/oldcircle-geo-sleuth/lockfile

테스트해 보기

"geo-sleuth" 사용 중입니다. Illustrative request: inspect an owned travel photo locally without external uploads.

예상 결과:

Illustrative result: no usable GPS metadata was available.
A partially readable sign provides a location hypothesis, not a verified conclusion.
Reverse image search was skipped because uploads were not authorized.
Next evidence needed: a clearer sign crop or a known landmark.

"geo-sleuth" 사용 중입니다. Illustrative request: compare two public-landmark candidates using reference imagery.

예상 결과:

Illustrative result: Candidate A remains the stronger area-level hypothesis.
Its reference imagery agrees with the landmark outline and nearby road layout.
Candidate B remains an alternative because its relevant frontage was not checked.
Camera coordinates and capture time remain unresolved.

"geo-sleuth" 사용 중입니다. Illustrative request: evaluate morning versus evening capture at a verified public location.

예상 결과:

Illustrative result: shadow direction supports the morning hypothesis under the supplied date assumption.
The date remains uncertain, so the capture-time range is conditional.
A second shadow measurement would help test the result.

보안 감사

높은 위험

v1 • 2026. 10. 11. 버전별 보고서 열기

Most static matches are false positives from Python identifiers, documentation, lookup tables, tests, and standard model operations. Confirmed risks include curl option injection, unvalidated thumbnail destinations, photo uploads without explicit consent, and inadequate safeguards for precise private-location identification. The static catalog covers 400 of 486 matches; 86 omitted matches still require manual review before automatic publication. Static review was capped at 400/486 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

스캔된 파일

44,220

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

SKILL.md:40-47 scripts/intake.py:130-132 scripts/intake.py:194-209 scripts/revimg.py:148-154 scripts/revimg.py:195-201

Photo Uploads Lack Explicit Consent

Default intake uploads the original photo and generated variants to Baidu and Yandex. No explicit upload consent or mandatory redaction step protects private image content.

The default engines and file-upload calls directly establish third-party transmission. Uploads can be disabled, but the documented first command does not require informed consent.

높음

SKILL.md:24 SKILL.md:131-148

Private-Location Precision Has Inadequate Safeguards

The privacy rule says to 'go to the finest level as usual' when a source or purpose is already stated. This exception can expose residences or locations associated with minors without establishing authorization.

The explicit exception bypasses the purpose question for sensitive images, while the output requirements support coordinates and building or floor precision. Harmful intent is not established.

기능 검토 항목 (2)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/_net.py:26

Python subprocess.run

result = subprocess.run(cmd + [url], capture_output=True, timeout=timeout + 5)

Remote thumbnail values reach curl arguments without URL validation or '--'. Option-shaped input can load curl configuration files; argument lists prevent shell injection, not option injection.

중간

scripts/revimg.py:104

Hardcoded URL

data = fetch_bytes(url, proxy, 15, {"User-Agent": UA, "Referer": "https://graph.baidu.com/"})

The download URL comes from remote thumbUrl fields, not the fixed Referer header. Unrestricted destinations and redirects can trigger requests to internal services.

위험 요인

🌐 네트워크 접근 (50)

data/calling_codes.json:4 data/driving_side.json:4 data/territories.json:4 regions/cn/data/admin.json:4 regions/cn/data/area_codes.json:11 regions/cn/data/plates.json:13 regions/README.md:63 scripts/_browser.py:12 scripts/_net.py:35 scripts/_net.py:36 scripts/_net.py:39 scripts/baidu_pano.py:40 scripts/doctor.py:35 scripts/doctor.py:36 scripts/doctor.py:37 scripts/doctor.py:38 scripts/doctor.py:39 scripts/doctor.py:40 scripts/doctor.py:41 scripts/doctor.py:46 scripts/evidence.py:10 scripts/gsv.py:39 scripts/gsv.py:40 scripts/gsv.py:36 scripts/osm.py:58 scripts/osm.py:59 scripts/osm.py:60 scripts/osm.py:63 scripts/poi.py:59 scripts/poi.py:82 scripts/poi.py:95 scripts/refresh.py:35 scripts/refresh.py:36 scripts/refresh.py:37 scripts/refresh.py:38 scripts/refresh.py:39 scripts/refresh.py:40 scripts/revimg.py:102 scripts/revimg.py:53 scripts/revimg.py:54 scripts/revimg.py:104 scripts/revimg.py:148 scripts/revimg.py:195 scripts/terrain.py:60 scripts/tiles.py:54 scripts/tiles.py:265 scripts/tiles.py:295 scripts/tiles.py:40 scripts/tiles.py:41 SKILL.md:157

⚙️ 외부 명령어 (50)

regions/cn/region.json:22 regions/cn/region.json:23 scripts/_browser.py:25 scripts/_browser.py:26 scripts/_net.py:26 scripts/board.py:126 scripts/board.py:9 scripts/board.py:80 scripts/board.py:81 scripts/board.py:83 scripts/board.py:84 scripts/board.py:100 scripts/board.py:244 scripts/board.py:245 scripts/board.py:484 scripts/board.py:494 scripts/board.py:518 scripts/board.py:578 scripts/board.py:611 scripts/board.py:628 scripts/board.py:629 scripts/board.py:630 scripts/board.py:631 scripts/board.py:653 scripts/board.py:655 scripts/board.py:657 scripts/board.py:658 scripts/board.py:665 scripts/board.py:678 scripts/board.py:766 scripts/board.py:767 scripts/board.py:768 scripts/board.py:1068 scripts/board.py:1170 scripts/clues.py:10 scripts/clues.py:11 scripts/clues.py:12 scripts/clues.py:16 scripts/clues.py:73 scripts/clues.py:196 scripts/clues.py:234 scripts/doctor.py:58 scripts/doctor.py:78 scripts/doctor.py:119 scripts/doctor.py:110 scripts/doctor.py:149 scripts/gsv.py:52 scripts/imgprep.py:14 scripts/intake.py:52 scripts/intake.py:223

🔑 환경 변수 (38)

📁 파일 시스템 접근 (37)

scripts/board.py:657 scripts/doctor.py:26 scripts/doctor.py:126 scripts/evidence.py:52 scripts/geo.py:522 scripts/geo.py:747 scripts/geo.py:948 scripts/geo.py:953 scripts/geo.py:955 scripts/geo.py:1005 scripts/geo.py:1034 scripts/geo.py:1050 scripts/intake.py:296 scripts/match.py:26 scripts/match.py:26 scripts/match.py:212 scripts/match.py:323 scripts/osm.py:532 scripts/pose.py:196 scripts/regions.py:347 scripts/revimg.py:64 scripts/revimg.py:323 scripts/revimg.py:326 scripts/tiles.py:120 tests/test_board.py:13 tests/test_board.py:23 tests/test_board.py:137 tests/test_regions.py:14 tests/test_regions.py:91 tests/test_runtime.py:17 tests/test_runtime.py:102 tests/test_runtime.py:152 tests/test_runtime.py:167 tests/test_runtime.py:193 tests/test_terrain.py:15 tests/test_terrain.py:75 tests/test_terrain.py:162

⚡ 스크립트 포함 (2)

scripts/match.py:99 scripts/sat_scan.py:128

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/oldcircle-geo-sleuth/security.svg)](https://skillstore.io/skills/oldcircle-geo-sleuth?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/oldcircle-geo-sleuth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oldcircle-geo-sleuth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/oldcircle-geo-sleuth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

oldcircle. (2026). geo-sleuth security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1

BibTeX 인용

@techreport{oldcircle-oldcircle-geo-sleuth-2026,
  author = {oldcircle},
  title = {geo-sleuth security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "geo-sleuth security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "oldcircle"
date-released: "2026-10-11"
url: "https://skillstore.io/skills/oldcircle-geo-sleuth/audits/1"
identifiers:
  - type: other
    value: "skillstore:oldcircle-geo-sleuth:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Verify Public-Scene Images

Compare a licensed public-scene photo with map and reference imagery, recording supporting evidence and unresolved location alternatives.

Organize Personal Photo Archives

Investigate locations and possible capture times for your own travel photos, starting locally and approving any external uploads.

Evaluate Geolocation Puzzles

Test authorized public-landmark puzzles using ranked candidates, explicit exclusions, comparison images, and uncertainty reports.

이 프롬프트를 사용해 보세요

Inspect a Photo Locally

Inspect my travel photo at [photo path] using intake with --no-rev. Summarize metadata, readable text, visible clues, and missing information. Do not upload it.

Compare Location Candidates

Compare [candidate places] for my public-landmark photo at [photo path]. Record clues on the candidate board and check them against maps. Ask before image uploads.

Estimate a Capture-Time Range

For my photo at [photo path], use [verified public location] and [possible dates] to evaluate sun and shadow constraints. Report assumptions and feasible time ranges.

Verify an Authorized Location Hypothesis

Investigate this authorized public-landmark puzzle at [photo path] within [search bounds] and [time budget]. Rank satellite cells and street-view candidates. Check geometry and produce evidence, alternatives, and uncertainty. Ask before image uploads.

모범 사례

Use owned or authorized public-scene photos, start with --no-rev, and approve external uploads only after reviewing privacy implications.
Record each clue and actual output file, then verify precision with independent constraints or stable ground-level features.
Set a search budget and report alternatives, coverage gaps, unresolved clues, and uncertainty.

피하기

Uploading sensitive photos without informed permission or using the workflow to identify private individuals or residences.
Treating similarity scores, editable metadata, or posting times as verified location or capture-time evidence.
Reporting exact coordinates or excluding candidates without sufficient checks and real evidence files.

자주 묻는 질문

Which assistants can use this skill?

The skill supports Claude, Codex, and Claude Code. Shell access and the documented runtime dependencies are required for script execution.

Does the skill upload my photo?

Default intake uploads original photos and variants to Baidu and Yandex. Use --no-rev to skip image uploads; other selected routes may still use network services.

Can it always identify an exact location?

No. Results depend on clues and reference coverage. The workflow can report a supported region, alternatives, or missing evidence instead of exact coordinates.

Can it determine when a photo was taken?

It can evaluate metadata and sun or shadow constraints. Without reliable dates, location, and measurements, capture-time estimates remain conditional.

What setup does it require?

Use Python 3.10+, uv, and curl. Reverse search needs Chrome or Playwright Chromium; image-ranking routes download model weights and install additional dependencies.

What remains unresolved in the security review?

Curl argument handling, thumbnail destination checks, upload consent, and private-location safeguards need improvement. Another 86 static matches require manual review.