C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Design & media
geo-sleuth
An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 39/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 3k
What it does
geo-sleuth is an AI agent skill that reverse-engineers photo locations using OpenStreetMap geometry, elevation data, satellite imagery, and street view integration. It demonstrates its reasoning process, helping AI agents like Claude and Gemini identify where images were taken with explainable results.
Who it’s for
Developers and builders integrating geolocation capabilities into AI agents; investigators, researchers, and security teams needing automated location verification from images. Best suited for teams using Claude, Cursor, Gemini CLI, or GitHub Copilot.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/Oldcircle/geo-sleuth (opens external site) for the latest setup steps. Likely involves installing via npm and configuring as an MCP server or agent skill in your AI platform's configuration file (e.g., Claude Desktop mcpServers JSON or equivalent). Specific copy-paste snippets should be obtained directly from the repository.
Risks
- Data exfiltration: Photos uploaded for geolocation analysis may be sent to third-party APIs (OpenStreetMap, satellite/street view services); verify data residency and retention policies
- Privacy exposure: Reverse-geolocating sensitive images (homes, offices, events) could inadvertently reveal private locations; implement access controls and audit logging
- API credential scope: If credentials for external mapping/imagery services are embedded, ensure minimal permission scopes and rotate regularly
- Prompt injection: Photo metadata or filenames could be manipulated to inject malicious instructions into the agent's reasoning chain
- Supply chain dependency: Relies on OpenStreetMap and third-party imagery providers; disruptions or compromises upstream could degrade functionality or leak data
How to stay secure
Least-privilege permissions
- Restrict who can use geo-sleuth — Only allow employees who genuinely need location analysis (e.g., research, investigations) to access this skill; deny access for others by default
- Limit API credentials — Ensure the tool's connection to mapping services (OpenStreetMap, satellite imagery providers) uses read-only access that cannot modify or delete data
- Rotate credentials monthly — Change any stored passwords or access keys that connect geo-sleuth to external services, similar to changing passwords for important accounts
- Disable photo storage — Configure the tool to immediately delete uploaded images after analysis completes, rather than saving them for later review
Network isolation
- Use a separate network zone — If possible, run geo-sleuth on a dedicated network segment that doesn't have broad access to your company's internal systems or sensitive databases
- Block unexpected destinations — Configure your firewall to allow geo-sleuth to contact only the specific mapping and imagery services it needs; block all other outbound connections
- Monitor data leaving your network — Set up alerts if unusually large amounts of photo data are uploaded to external services, which could indicate a security breach
Monitoring
- Log all analysis requests — Record who used geo-sleuth, which photos were analyzed, and when—similar to security camera footage that shows who accessed a locked room
- Track what gets exported — Note whenever someone downloads results or shares location findings with others; flag unusual patterns (e.g., analyzing competitor offices repeatedly)
- Review third-party data sharing — Regularly verify that external mapping providers aren't retaining your company's uploaded photos longer than necessary by checking their privacy policies
Red flags to watch for
- Photos with suspicious filenames — Be cautious if filenames contain unusual instructions or code-like text (e.g., "photo_IGNORE_SECURITY_RULES.jpg"), which could attempt to manipulate the tool's behavior
- Bulk analysis of private locations — Alert security if someone suddenly analyzes many photos of homes, offices, or other sensitive sites—could indicate identity theft or corporate espionage preparation
- Unexpected service outages — If geo-sleuth suddenly stops working or returns errors from mapping services, it may indicate an upstream compromise; pause use until verified as safe
Alternatives
- Google Lens API – cloud-based image analysis with broader object/landmark recognition
- TinEye – specialized reverse image search and location verification
- Exif/metadata extraction tools – lightweight local alternative for basic geolocation from embedded photo data
- Commercial OSINT platforms (e.g., IntelX, Bellingcat tools) – enterprise-grade with compliance certifications