Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Amap walking-route planner, but users should understand that entered locations are sent to Amap APIs.
Install only if you are comfortable sending the locations or addresses you provide to Amap for geocoding, place search, weather, walking-route calculation, and QR-code route generation. Prefer approximate starting points when privacy matters, and protect the AMAP_API_KEY like any other API credential.
The skill description explains setup and API usage but does not give users a prominent, upfront warning that their location or address will be transmitted to Amap's external HTTP APIs for geocoding, search, weather, and route generation. Because location data is highly sensitive, this omission can prevent informed consent and lead to privacy-impacting disclosures.
The skill is activated by very broad natural-language prompts such as telling it where you are and how far you want to walk, without clear trigger boundaries or exclusions. This increases the chance of unintended invocation and accidental disclosure of sensitive location data to the route-planning workflow and downstream external APIs.
