Map Integration Service

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:09 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a normal map integration, but it declares access to broad shared credential files when it only needs one map API key.

Review this before installing if your OpenClaw .env files contain unrelated tokens. Prefer providing only AMAP_WEBSERVICE_KEY through a scoped environment variable or a dedicated credentials file containing only the map service key.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:9

Finding

Overly Broad Access to Shared Credential Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-13
Vulnerability Type: Excessive credential access scope
Risk Level: Medium

yaml

config:
  - path: ~/.openclaw/.env
    description: Environment file for API keys
  - path: ~/.openclaw/credentials/.env
    description: Alternative credentials location

Technical Analysis

The Skill requires only the AMAP_WEBSERVICE_KEY environment variable, but its configuration declares two entire shared environment files as credential sources. These files may contain unrelated API keys, access tokens, or other secrets used by different Skills and services.

If the OpenClaw host treats the config entries as authorization or instructions to load these files, secrets unrelated to the Skill's map functionality could become available in the Skill or Agent execution environment. This exceeds the least-privilege access required for geocoding, routing, and POI search.

The reviewed file does not instruct the Agent to disclose, transmit, or misuse these credentials. Therefore, this is an excessive-access and blast-radius issue rather than evidence of intentional credential theft.

Attack Path

1. A user stores AMAP_WEBSERVICE_KEY and unrelated credentials in one of the declared shared .env files.
2. The host loads the Skill and processes its file-level configuration declarations.
3. The host reads the entire shared environment file rather than retrieving only AMAP_WEBSERVICE_KEY.
4. Unrelated secrets become accessible to the Skill, Agent context, or associated tools.
5. A later malicious prompt, compromised tool, or vulnerable integration could read or disclose those unrelated secrets.

This exploitation path depends on the host interpreting the metadata as permission to read or import the complete files.

Impact Assessment

The Skill could gain read access to credentials beyond those necessary for its declared map-service functionality. The pre ...[truncated 390 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both file-level config declarations and request only the named AMAP_WEBSERVICE_KEY environment variable through the existing credential metadata.
2. If file-based configuration is mandatory, use a dedicated provider-specific file containing only the Amap key rather than shared OpenClaw environment files.
3. Configure the host to allowlist individual variable names and avoid injecting every value from a shared .env file into the Skill context.
4. Apply restrictive filesystem permissions to any dedicated credential file, allowing access only to the owning user.
5. Ensure credentials are passed directly to the map API client and are never included in generated URLs, logs, responses, or Agent-visible diagnostic output.
6. Document key rotation and revocation procedures in case a shared environment file was previously exposed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

optional: true
    source: env
config:
  - path: ~/.openclaw/.env
    description: Environment file for API keys
  - path: ~/.openclaw/credentials/.env
    description: Alternative credentials location

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

optional: true
    source: env
config:
  - path: ~/.openclaw/.env
    description: Environment file for API keys
  - path: ~/.openclaw/credentials/.env
    description: Alternative credentials location

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

When API key is needed:

1. Get API key from your map service provider
2. Add to OpenClaw config:

   text

   AMAP_WEBSERVICE_KEY=your_key
   

Static analysis

No suspicious patterns detected.