Security audit

Baidu Maps Sse

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent maps gateway skill, but it should be reviewed because it tells users to run unpinned external packages and silently falls back to a shared demo access key.

Review before installing. Use a local virtual environment instead of global installs, pin npm and Python package versions, avoid npx latest-resolution workflows, set your own DEEPNLP_ONEKEY_ROUTER_ACCESS key, and avoid submitting sensitive home, work, or travel locations unless you are comfortable sending them through OneKey Gateway and the downstream map provider.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/maps_directions.py:10
Finding: Public Shared Gateway Credential Is Used as a Silent Fallback
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares environment variable usage and references local scripts, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scope boundaries can cause the runtime to grant broader-than-necessary capabilities, increasing the chance of unintended file access or secret exposure if the skill or its dependencies behave unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill handles addresses and coordinates but does not clearly warn users that these inputs will be transmitted to external commercial APIs through OneKey Gateway. This omission creates a privacy/security issue because location data can be sensitive, and users may disclose it without informed consent about third-party processing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx onekey without a pinned package version means execution depends on whatever version is current at install/runtime. This creates a supply-chain risk where a compromised, malicious, or breaking upstream release could be fetched and executed automatically.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command invokes npx onekey without version pinning, allowing an unreviewed upstream package version to be downloaded and executed. In agent or automation contexts, this increases the chance of remote code execution through dependency compromise or unexpected package updates.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx onekey invocation exposes users to supply-chain drift and arbitrary upstream changes at execution time. If the package namespace or latest release is compromised, the skill instructions would direct execution of attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Because npx onekey is not version-pinned, the command may execute different code over time depending on the latest published package. That weakens reproducibility and opens a practical supply-chain attack path for anyone following the documented command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This example relies on npx resolving a package at runtime without a fixed version, which can silently pull newer or malicious code. In security-sensitive agent environments, dynamic package resolution materially raises remote execution risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: An unpinned npx onekey command permits runtime retrieval of whatever upstream version is current, undermining trust and repeatability. If exploited through package compromise, users could run malicious code while attempting routine map operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command at this line uses npx onekey without constraining the package version, creating a classic dependency/supply-chain exposure. The danger is heightened because the skill is intended to be copied and run directly from documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script takes user-supplied origin and destination data and transmits it to an external routing service without any notice, consent prompt, or privacy disclosure in the code path. Because location data is sensitive and can reveal habits, home/work addresses, or travel plans, sending it off-box implicitly creates a privacy and data-handling risk even if the transmission is expected for functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script sends the loaded payload to an external router via router.invoke(...), which is a network operation that may transmit user or system data. While the CLI argument names imply input is being used, there is no confirmation prompt, warning message, comment, or docstring disclosing that the data will be sent to a remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script sends the user-provided payload to router.invoke(...), which is a network/API operation, but the file provides no confirmation prompt, warning message, or comment/docstring disclosing that input data will be transmitted externally. For a code file, this qualifies as a missing user warning for an HTTP/network call that may transmit user or system data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code invokes a remote router API and transmits the contents of the user-supplied payload, but there is no confirmation prompt, warning message, or explanatory comment/docstring disclosing that data will be sent off-box. Because the transmitted data may come from a file or command-line JSON input, users are not clearly informed in this file that their input is being sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code sends the user-provided payload, including latitude and longitude, to an external router service via router.invoke(...). Although the script prints the result, it does not provide any prior notice, confirmation, comment, or docstring disclosing that location data will be transmitted off-box.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script forwards user-supplied payload data directly to an external router service without any disclosure, confirmation, or minimization. This creates a privacy and data-handling risk because users may provide sensitive location queries or related metadata without realizing it will be transmitted to a third-party network endpoint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is named and described as "baidu-maps-sse," which implies Baidu Maps functionality, but the documented maps_search_places tool explicitly says it uses the Google Places API. This is a semantic mismatch in the skill's stated identity and behavior, not just an implementation detail, because the user-facing documentation identifies a different mapping provider than the skill name suggests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline documentation for maps_search_places says "Search for places using Google Places API" while the surrounding skill branding and name indicate this is a Baidu Maps skill. That is an active contradiction in the documentation about what the tool actually does or is intended to do.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code reads an access token from the DEEPNLP_ONEKEY_ROUTER_ACCESS environment variable to authenticate with the external router. There is no user-facing notice, comment, or docstring explaining that credentials are being sourced from the environment and used for a remote API call.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script embeds a default router access credential in code and falls back to it whenever the environment variable is unset. Hardcoded or default secrets in distributable tooling can be extracted and reused by unauthorized parties, enabling unintended access to the upstream OneKey router service and making abuse difficult to contain once published.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script falls back to a hardcoded router access key when the expected environment variable is absent. Embedding a usable credential in code is a real secret-management flaw because anyone with code access can invoke the upstream router, potentially outside the intended Baidu Maps scope, and the env-var behavior does not mitigate that exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script reads DEEPNLP_ONEKEY_ROUTER_ACCESS from the environment to authenticate with the external router, but there is no comment, docstring, or user-facing description explaining that credentials are consumed. Under the missing-warning rule for code files, sensitive credential access without any disclosure should be flagged.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes an auto-generated skill for Baidu Maps tools, which justifies calling the gateway/router but does not itself indicate credential access behavior. Reading DEEPNLP_ONEKEY_ROUTER_ACCESS adds a capability to access process environment data that is not stated in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The code reads DEEPNLP_ONEKEY_ROUTER_ACCESS from the environment, which is credential-related access. There is no visible warning, log, or explanatory comment indicating that the script consumes an access token from the environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.