Gaode-Map-skills

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:03 PM UTC
• Version: 1.0.0

Overview

This is a straightforward Gaode Map skill that sends user-supplied map queries to AMap and uses an API key, with some manageable privacy and dependency hygiene caveats.

Install only if you are comfortable sending map searches, addresses, and route endpoints to AMap. Prefer AMAP_API_KEY over the --key command-line option, use a restricted AMap key, and pin or review the requests dependency before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Permits Non-Reproducible Installations

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; installation instruction at README.md:12-15
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

requests

README.md:12-15:

markdown

2. Install dependencies:
   ```bash
   pip install -r requirements.txt
   ```

Technical Analysis

The project declares requests without a version constraint or package hash. Consequently, each installation may resolve to a different release from the configured Python package index. The code ultimately imported and executed is therefore not fixed to the version reviewed during this audit.

An unpinned dependency does not prove that the current requests package is malicious. However, it creates a supply-chain weakness: a future compromised, malicious, or incompatible release could be installed automatically. The absence of hashes also means the installer does not verify that the downloaded distribution is the exact artifact approved by the project maintainer.

Attack Path

1. An attacker compromises a dependency release or the package distribution channel used by the victim.
2. The victim follows the documented command, pip install -r requirements.txt.
3. pip resolves the unconstrained requests dependency to the affected release.
4. The unreviewed package is installed into the Skill's Python environment.
5. Package code executes when imported by amap_tool.py, inheriting the privileges and environment available to the Agent process.

Impact Assessment

If a malicious dependency version is installed, it could execute Python code with the privileges of the user running the installation or Skill. Depending on that environment, this could expose the AMAP_API_KEY, user-provided location data, local files accessible to the Agent, and other process environment variables. It could also alter network request ...[truncated 133 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a specifically reviewed version, for example:

   text

   requests==<reviewed-version>
   

2. Pin transitive dependencies as well by generating a lock file with a dependency-management tool such as pip-tools.

3. Record cryptographic hashes for every approved distribution and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Obtain packages only from a trusted, explicitly configured index.

5. Add automated dependency vulnerability scanning and controlled update reviews so pinned packages continue to receive security updates.

6. Perform dependency installation in an isolated virtual environment and run the Skill with minimal filesystem and environment access.

T09 · Insecure Skill Coding Practices

Note

• Location: amap_tool.py:113

Finding

AMap API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: amap_tool.py:113-120
Vulnerability Type: Insecure secret handling through process arguments
Risk Level: Low

Vulnerable Code

python

parser.add_argument("--key", help="AMap API Key (can also be set via AMAP_API_KEY env var)")
parser.add_argument("--keywords", help="Keywords for place search")
parser.add_argument("--city", help="City for search or route planning")
parser.add_argument("--origin", help="Origin for route planning")
parser.add_argument("--destination", help="Destination for route planning")
parser.add_argument("--mode", default="driving", choices=["driving", "walking", "bicycling", "transit"], help="Route planning mode")

args = parser.parse_args()

api_key = args.key or os.environ.get("AMAP_API_KEY")

Technical Analysis

The --key option allows a secret API credential to be supplied directly in the command line. Command-line arguments may be retained in shell history, process-execution telemetry, job logs, audit systems, or orchestration metadata. Depending on operating-system configuration, they may also be visible to other local processes or users through process inspection while the command is running.

Although the environment-variable alternative is already supported and documented, accepting the CLI argument creates an avoidable credential-exposure path. The code does not itself print the key, and no hardcoded credential was found.

Attack Path

1. A user invokes the tool with a command such as python amap_tool.py search --key SECRET --keywords coffee.
2. The complete command is recorded in shell history, process telemetry, an automation log, or another command-capture mechanism.
3. An actor with access to that record retrieves the API key.
4. The actor submits requests to AMap using the exposed credential.
5. The attacker can consume the associated quota and perform operations permitted by that AMap key until it is revoke ...[truncated 504 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --key argument and accept the credential only from AMAP_API_KEY or a dedicated secret-management service.
2. If a configuration file is supported, require restrictive file permissions and ensure it is excluded from version control.
3. Avoid placing the key in logs, exception messages, telemetry, or generated URLs exposed to users.
4. Apply AMap provider-side restrictions, including service scope, quota limits, and any supported source restrictions.
5. Rotate the key if it has previously been passed through command-line arguments, because it may already exist in shell histories or logs.
6. Run the Skill with a narrowly scoped key dedicated to this integration rather than a credential shared with other applications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 3)May include surrounding context.

text

__pycache__/
*.pyc
.env
.DS_Store

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires access to an environment secret (AMAP_API_KEY) and performs networked actions, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability because an agent runtime may grant broader execution capability than is obvious from the manifest, increasing the risk of unintended secret exposure or uncontrolled external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Place search sends user-supplied keywords and optional city data to the external AMap service without any explicit disclosure, consent flow, or privacy notice in the tool behavior. In a location context, even seemingly simple queries can reveal sensitive intent, whereabouts, or personal routines if forwarded to a third party unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Geocoding forwards raw user-provided addresses to an external API, which can expose highly sensitive personal or business location information. Because addresses are more precise than general search terms, the privacy risk is elevated if users are not clearly informed that their input leaves the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Route planning sends origin and destination values to a third-party service, potentially disclosing travel patterns, home/work locations, or other sensitive movements. In a mapping skill this network transfer is expected functionally, but the lack of transparent disclosure still creates a real privacy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest description limits the skill to location search and route planning, while the implementation includes a separate geocoding capability that converts arbitrary addresses to coordinates. Although geocoding is used internally for routing, it is still an additional map capability beyond the exact wording of the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill's stated purpose is interacting with Gaode Map for search and routing, but the code also accesses process environment variables to obtain credentials. While common operationally, reading local environment state is a separate capability not described in the manifest's functional scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency manifest specifies requests without a version constraint, which makes builds non-reproducible and can cause the environment to install an unexpectedly old or newly broken release. In a skill that interacts with external map/network APIs, this increases supply-chain and stability risk because behavior and security posture depend on whatever version is resolved at install time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Because requests is unpinned, it is not possible to verify whether installation will pull a version affected by known advisories, including credential leakage and other historical issues. This is especially relevant for a map integration skill that will make outbound HTTP requests and may handle API keys or authentication material, so vulnerable requests versions could expose sensitive data or weaken transport security.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.