Baidu Map IOS SDK（百度地图官方IOS SKills）

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:15 PM UTC
• Version: 1.0.2

Overview

This Baidu Maps iOS skill is mostly purpose-aligned, but it includes risky setup guidance that can change global developer tooling and weaken build protections.

Review before installing. Prefer a project-local Gemfile with pinned CocoaPods and Pod versions, keep trusted package sources unless you intentionally use an organizational mirror, avoid unrestricted pod update, and do not disable Xcode User Script Sandboxing unless you approve a temporary exception. Also verify generated app code requests location or camera permissions only when needed and shows the required privacy consent flow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: references/cocoapods.md:8

Finding

Privileged CocoaPods Installation Through a Third-Party RubyGems Source

Content

View full analysis

Vulnerability Details

File Location: references/cocoapods.md, lines 8-13
Vulnerability Type: Supply-chain exposure during privileged system-wide package installation
Risk Level: High

Vulnerable Code

bash

gem sources -l
gem sources --remove https://rubygems.org/
gem sources -a https://gems.ruby-china.com
sudo gem update --system
sudo gem install -n /usr/local/bin cocoapods  # macOS > 10.11
pod setup

Technical Analysis

The installation procedure removes the official RubyGems registry and replaces it with a third-party mirror. It then updates RubyGems and installs CocoaPods system-wide using sudo.

Ruby gems can contain installation logic and executable components. If the configured mirror, its distribution infrastructure, or a package served through it is compromised, attacker-controlled package content may execute with root privileges during installation. The procedure does not pin the CocoaPods version, validate an artifact digest, verify a package signature, or otherwise establish that the downloaded package is identical to a reviewed release.

Removing the official source also changes package resolution globally for the affected RubyGems installation, potentially influencing later gem installations beyond the current Baidu SDK integration task.

Attack Path

1. A developer or Agent follows the documented CocoaPods installation procedure.
2. The official rubygems.org source is removed from the local RubyGems configuration.
3. Package resolution is redirected to gems.ruby-china.com.
4. An attacker compromises the mirror, its upstream synchronization process, or a package available through it.
5. The developer runs sudo gem update --system or sudo gem install.
6. Malicious package installation logic executes with elevated privileges.
7. The attacker can modify system-wide development tooling or access resources available to the root installation process.

Im

...[truncated 549 chars]

Remediation

View remediation

Remediation Suggestions

• Do not remove the official https://rubygems.org/ source.
• Do not use sudo gem update --system as part of project setup.
• Install a specifically reviewed CocoaPods version rather than an unconstrained latest release.
• Prefer a repository-local Gemfile and committed Gemfile.lock, executed through bundle exec pod.
• Use a user-scoped Ruby version manager or another non-root installation method.
• If an organizational mirror is required, retain a trusted upstream policy and verify mirror ownership, TLS configuration, package integrity, and synchronization controls.
• Validate package checksums or signatures where supported.
• Require explicit user confirmation before changing global package sources or performing privileged installation.

T08 · Insecure Dependencies

Warning

• Location: references/cocoapods.md:26

Finding

Unpinned SDK Dependencies and Unrestricted CocoaPods Updates

Content

View full analysis

Vulnerability Details

File Location: references/cocoapods.md, lines 26-51
Vulnerability Type: Non-reproducible dependency resolution and unsafe broad updates
Risk Level: Medium

Vulnerable Code

ruby

# Basic map: omitting a version uses the latest release
platform :ios, '10.0'
target 'YourProjectTarget' do
    pod 'BaiduMapKit'
    # pod 'BaiduMapKit/Map'
    # pod 'BaiduMapKit/Search'
    # pod 'BaiduMapKit/Utils'
end

ruby

# Walking and cycling navigation
platform :ios, '10.0'
target 'YourProjectTarget' do
    pod 'BaiduWalkNaviKit'
end

bash

pod install
pod repo update
pod update

Technical Analysis

BaiduMapKit and BaiduWalkNaviKit are declared without version constraints. The documentation explicitly states that omitting the version installs the latest available release and recommends pod update, which can update direct and transitive dependencies.

This prevents deterministic dependency resolution unless a separately maintained lockfile is present and enforced. A package published or modified after the Skill was reviewed can therefore become part of the generated application without a corresponding review of its source, binary contents, permissions, build scripts, or transitive dependencies.

The Skill does not require a committed Podfile.lock, verify checksums, restrict dependency sources, or require review of package changes before compilation.

Attack Path

1. The Agent creates a Podfile containing unpinned SDK dependencies.
2. The Agent runs pod repo update or pod update.
3. CocoaPods resolves the newest available direct and transitive package versions.
4. A compromised, malicious, or unexpectedly changed upstream release is selected.
5. CocoaPods integrates package binaries, resources, and build phases into the Xcode workspace.
6. The Skill's mandatory build process executes the resulting build configuration.
7. Mal ...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct Pod to an exact, reviewed version.
• Commit Podfile.lock and enforce it in continuous integration.
• Use pod install for normal reproducible installations; reserve targeted updates for deliberate dependency-upgrade work.
• Avoid unrestricted pod update; use a targeted update for one reviewed package when necessary.
• Review all direct and transitive dependency changes before accepting an updated lockfile.
• Restrict Pod sources to expected, trusted repositories.
• Inspect vendored binaries and build-phase scripts included by dependencies.
• Add dependency inventory, checksum, and vulnerability scanning to CI.
• Treat compilation success as a correctness check, not as a security or integrity verification.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/project-config.md:77

Finding

Global Disabling of Xcode User-Script Sandboxing

Content

View full analysis

Vulnerability Details

File Location: references/project-config.md, lines 77-91
Vulnerability Type: Build-script isolation weakened for third-party dependency scripts
Risk Level: Medium

Vulnerable Code

markdown

## CocoaPods Build Sandbox (Xcode 15+)

CocoaPods' Copy Pods Resources script needs to create temporary files in the
`Pods` directory. Xcode 15 enables User Script Sandboxing by default and may
prevent this write.

**Solution**: Set `ENABLE_USER_SCRIPT_SANDBOXING = NO` in the target's
Build Settings.

- **Xcode GUI**: Select target → Build Settings → User Script Sandboxing → No
- **project.pbxproj**:

text

ENABLE_USER_SCRIPT_SANDBOXING = NO;

Technical Analysis

Xcode user-script sandboxing limits build-phase scripts to declared input and output paths. Disabling it at the target configuration level broadens filesystem access for all scripts executed in that target, including scripts introduced by CocoaPods dependencies.

The recommendation applies the workaround to target build configurations rather than correcting script input/output declarations or upgrading incompatible tooling. This weakens a security boundary for both Debug and Release builds.

The issue compounds the unpinned-dependency risk: a newly resolved Pod may introduce or modify a build script, and the mandatory build workflow will execute it after sandbox protections have been disabled.

Attack Path

1. The developer or Agent sets ENABLE_USER_SCRIPT_SANDBOXING = NO.
2. An installed or updated Pod contributes a malicious or compromised Xcode build-phase script.
3. The Skill instructs the Agent to invoke xcodebuild.
4. Xcode executes the dependency's script without user-script sandbox restrictions.
5. The script accesses or modifies files beyond its legitimate declared build inputs and outputs.
6. The script may alter source files, generated applications, build configuration, or other data ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

• Keep ENABLE_USER_SCRIPT_SANDBOXING = YES.
• Upgrade CocoaPods and affected Pods to releases compatible with Xcode script sandboxing.
• Correctly declare build-script input and output paths instead of disabling the sandbox.
• Audit every CocoaPods-generated and dependency-provided build phase before execution.
• If a temporary exception is unavoidable, require explicit developer approval, scope it to the minimum necessary configuration and target, document the reason, and restore sandboxing immediately afterward.
• Add CI checks that reject committed project settings containing ENABLE_USER_SCRIPT_SANDBOXING = NO unless an approved exception exists.
• Combine sandbox enforcement with pinned dependencies and lockfile verification.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (39)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

集成地图或涉及全屏展示时，**必须**确保工程已配置 Launch Screen，避免运行后出现黑边、非全屏。具体见 [project-config.md](references/project-config.md)「窗口初始化/Launch Screen」：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

集成地图或涉及全屏展示时，**必须**确保工程已配置 Launch Screen，避免运行后出现黑边、非全屏。具体见 [project-config.md](references/project-config.md)「窗口初始化/Launch Screen」：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

集成地图或涉及全屏展示时，**必须**确保工程已配置 Launch Screen，避免运行后出现黑边、非全屏。具体见 [project-config.md](references/project-config.md)「窗口初始化/Launch Screen」：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cocoapods.md (reported line 58)May include surrounding context.

bash

pod setup
rm ~/Library/Caches/CocoaPods/search_index.json
pod search BaiduMapKit   # 或 pod search BMKLocationKit

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states the skill provides development规范 and outputs professional map solutions entirely in Chinese, with no indication that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's instructional content is written entirely in Chinese and does not indicate that another language is available or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown skill content appears to force a specific language for all users, and it does not offer any opt-in, alternative language, or justification for the locale constraint. Under the policy, language-specific instructions without user choice or documented regional scope are a natural-language policy violation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cocoapods.md (reported line 11)May include surrounding context.

gem sources -l gem sources --remove https://rubygems.org/ gem sources -a https://gems.ruby-china.com sudo gem update --system sudo gem install -n /usr/local/bin cocoapods # macOS > 10.11 pod setup

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/cocoapods.md (reported line 12)May include surrounding context.

gem sources -l gem sources --remove https://rubygems.org/ gem sources -a https://gems.ruby-china.com sudo gem update --system sudo gem install -n /usr/local/bin cocoapods # macOS > 10.11 pod setup

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file explains enabling showsUserLocation and passing location data to the map, which affects sensitive user location data. Under the markdown-file criteria for SQP-2, there is no accompanying user-facing warning about privacy implications, permissions, or careful handling of precise location data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill guidance is written only in Chinese, with no indication that users may choose another language or that the skill is restricted to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file title and all instructional content are written in Chinese, and the guidance is presented as mandatory operational rules without any indication that another language is supported. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The entire skill file is written only in Chinese and provides no indication that another language can be used or that the locale is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cocoapods.md (reported line 66)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/location.md (reported line 35)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/location.md (reported line 92)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/location.md (reported line 125)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/project-config.md (reported line 3)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/project-config.md (reported line 7)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/project-config.md (reported line 9)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/project-config.md (reported line 18)May include surrounding context.

md

# 工程配置

**边界**：Info.plist、隐私弹窗、Launch Screen、CocoaPods 沙盒等百度 SDK 工程配置；Pod 集成见 [cocoapods.md](cocoapods.md)。

**Agent 注意**：集成地图/定位 SDK 时，必须检查或配置 Launch Screen（见下「窗口初始化/Launch Screen」），避免运行后 App 非全屏、黑边；并主动提示开发者配置 AK 与 Bundle Identifier（与百度控制台一致）。

Static analysis

No suspicious patterns detected.