Baidu Map JSAPI UI Kit（百度地图官方 JSAPI UI-Kit SKills）

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:22 AM UTC
• Version: 1.0.5

Overview

This is a coherent Baidu Maps UI documentation skill, with expected external map-service use and no hidden execution or persistence.

Before using this skill, be comfortable with Baidu Maps receiving map searches, selected POIs, place UIDs, and route coordinates. For production apps, pin @baidumap/jsapi-ui-kit to a reviewed version, pin or self-host CDN assets with SRI where practical, and avoid entering sensitive location data unless that data sharing is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/getting-started.md:6
• Finding: Unpinned Third-Party Package and CDN Resources Without Integrity Protection<![CDATA[ ## Vulnerability Details **File Location**: `references/getting-started.md`, lines 6 and 21-22 **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Complete Vulnerable Code Snippets ```bash npm install @baidumap/jsapi-ui-kit ``` ```html <link rel="stylesheet" href="https://unpkg.com/@baidumap/jsapi-ui-kit/dist/css/jsapi-ui-kit.css"> <script src="https://unpkg.com/@baidumap/jsapi-ui-kit/dist/jsapi-ui-kit.iife.js"></script> ``` ### Technical Analysis The installation command does not specify an exact package version, so package resolution may select a future release that was not reviewed with this Skill. The CDN URLs similarly omit a version and therefore resolve mutable package content. The JavaScript resource is loaded directly from an external CDN and is not protected by a Subresource Integrity (`integrity`) hash. Consequently, applications following this example trust both the package publication channel and CDN delivery infrastructure to provide executable content. If the package account, package release process, or CDN is compromised, altered JavaScript could execute within the consuming application's browser origin. This finding does not establish that the current package or CDN content is malicious. It identifies a supply-chain weakness caused by mutable dependency resolution and absent integrity verification. ### Attack Path 1. An attacker compromises the npm package publisher, release pipeline, or relevant CDN delivery path. 2. The attacker publishes or serves a modified release of `@baidumap/jsapi-ui-kit`. 3. A developer follows the documented unversioned npm command or uses the unversioned UNPKG URL. 4. The package manager or CDN resolves the attacker-controlled version. 5. The modified JavaScript executes when the application is built or when a user loads the affected page. 6. The payload operates with the browser privileges available to scripts in that application origin. ### Impact Assess ...[truncated 718 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm dependency to an exact reviewed version: ```bash npm install --save-exact @baidumap/jsapi-ui-kit@1.0.1 ``` 2. Commit and enforce a package-manager lockfile so transitive dependencies are reproducible. 3. Pin CDN resources to the same reviewed version: ```html <link rel="stylesheet" href="https://unpkg.com/@baidumap/jsapi-ui-kit@1.0.1/dist/css/jsapi-ui-kit.css" integrity="sha384-REPLACE_WITH_VERIFIED_HASH" crossorigin="anonymous"> <script src="https://unpkg.com/@baidumap/jsapi-ui-kit@1.0.1/dist/jsapi-ui-kit.iife.js" integrity="sha384-REPLACE_WITH_VERIFIED_HASH" crossorigin="anonymous"></script> ``` 4. Generate integrity hashes from independently verified release artifacts rather than copying unverified hashes from the same delivery channel. 5. Prefer self-hosting reviewed static artifacts where operationally practical. 6. Use dependency scanning, package provenance verification, and controlled upgrade reviews before changing pinned versions. 7. Apply a restrictive Content Security Policy to reduce the impact of a compromised browser dependency. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

External Transmission

Medium

• Category: Data Exfiltration

Content

使用前需先加载百度地图 JS API：

```html
<script src="https://api.map.baidu.com/api?v=1.0&type=webgl&ak=YOUR_AK"></script>
```

## 基础示例

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

使用前需先加载百度地图 JS API：

```html
<script src="https://api.map.baidu.com/api?v=1.0&type=webgl&ak=YOUR_AK"></script>
```

## 基础示例

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The natural-language content in the description and body is entirely Chinese, and the file does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when users are not given an explicit opt-in or justification for the constraint.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations. This file presents all instructions, examples, and notes exclusively in Chinese, with no statement that the skill is China-specific or that other language options are unavailable by design.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This is a markdown file, so SQP-2 applies to missing user-facing warnings in the skill description. The document describes manual search, real-time suggestions, and linked PlaceSearch behavior, but does not disclose that typed keywords, selected POIs, and related location context are likely transmitted to external map APIs, which has privacy implications.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: This markdown file is entirely presented in Chinese, and there is no indication that the skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This file presents all user-facing documentation, examples, and descriptions exclusively in Chinese. Under the policy rule for language or locale constraints, forcing a single language without opt-in or justification can be considered a natural-language policy violation.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The note states that only driving route planning is currently open, which sets a clear expectation about supported functionality. Later documentation presents `getCurrentType()` as returning `'driving' | 'transit' | 'riding' | 'walking'` and documents `typechange` events generically, creating an active contradiction about what is actually available now.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The comment says the listed enums are 'not yet open', but the example immediately imports `TransitPolicy`, `IntercityPolicy`, `TransitTypePolicy`, and `LineType` from the package as if they are available for use. That is an intent/documentation contradiction rather than mere incompleteness.

Static analysis

No suspicious patterns detected.