ClawHub
Back to skill

Security audit

amapgeo

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent AMap location helper; users should understand that map searches, addresses, and coordinates may be sent to AMap when they use it.

Install only if you are comfortable using AMap for these lookups. Avoid sending home, workplace, or other sensitive precise locations unless needed, and prefer explicit map requests when invoking the skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad and overlap with ordinary conversational requests such as asking for nearby places or directions. This can cause the skill to activate unexpectedly and send user queries or inferred location-related data to the external map service without clear intent, creating privacy and UX risks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation does not clearly warn users that their addresses, coordinates, POI searches, and route queries will be transmitted to Amap, a third-party service. Because location and search context can be sensitive personal data, the lack of disclosure and consent increases privacy risk and may violate user expectations or compliance requirements.

Static analysis

No suspicious patterns detected.