Baidu Map Cli（百度地图官方Cli工具）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:04 AM UTC
• Version: 1.0.2

Overview

This Baidu Maps skill is mostly coherent, but it asks agents to install and execute an unverified remote CLI, activate additional skills, and persist API keys across sessions.

Install only if you trust the Baidu-hosted CLI and any skills it installs. Before allowing setup, verify the CLI through an official checksum or signature when possible, review every proposed config change, use narrowly scoped demo AKs instead of production keys, avoid wildcard referrers outside local testing, and know where persisted tokens and MCP credentials are stored so you can remove or rotate them later.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:101

Finding

Remote Binary Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

**Security notice (ASI04)**: The current download process has no built-in checksum or signature verification. Binary authenticity depends on trusting `open-agent-cli.bj.bcebos.com`. To verify it, obtain the SHA-256 checksum for the version through an official Baidu Maps Open Platform channel and compare it using `sha256sum "$BMAP_CLI"` after downloading. ``` ```bash test -x "$BMAP_CLI" ``` When the preceding command fails, the Skill instructs the agent to execute: ```bash curl -fL "https://open-agent-cli.bj.bcebos.com/cli/bmap-cli--" -o "$BMAP_CLI" ``` ```bash chmod +x "$BMAP_CLI" ``` ### Technical Analysis The Skill downloads a native executable from a remote URL, grants it executable permissions, and subsequently invokes it for installation, authentication, credential management, and configuration operations. The workflow does not require a pinned checksum, cryptographic signature, immutable version identifier, or verified release manifest. HTTPS protects the connection in transit but does not establish that the hosted artifact is the intended reviewed binary. If the hosting account, storage bucket, release process, DNS resolution, certificate infrastructure, or publication credentials are compromised, the downloaded payload can be replaced without changing this Skill file. The text acknowledges the absence of verification, but checksum verification is optional rather than an enforced prerequisite. User confirmation of the download domain also does not verify the integrity of the artifact served by that domain. ### Attack Path 1. An attacker compromises the remote artifact host, its publication credentials, or another part of the binary distribution pipeline. 2. The attacker replaces the platform ...[truncated 1156 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:161

Finding

Dynamically Installed Skills Are Activated Without Artifact Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:166

Finding

API Keys Are Persisted in Plaintext Runtime Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:269

Finding

Real API Keys Are Required to Be Embedded Directly in Generated Source Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents the skill entirely in Chinese and frames its operation as mandatory for covered tasks, without offering a language choice or documenting that Chinese is required for a justified regional-compliance reason. This can violate language/locale policy when users have not opted into Chinese-language interaction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill declares itself applicable to a very wide range of Baidu Maps development and coding tasks, effectively forcing invocation before documentation lookup or code writing. Overly broad activation can hijack unrelated user workflows and drive unnecessary installation, login, configuration, or credential-handling steps, increasing attack surface and the chance of unsafe side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation criteria are based on broad scenario categories rather than precise triggers, so the skill may activate on common requests that merely mention maps, routing, geocoding, demos, or HTML. In this skill context, activation leads to command execution paths, credential setup, and config mutation, making accidental invocation materially risky.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill instructs copying installed skills, persisting tokens, and reusing configuration within the environment, which can silently extend credential lifetime and exposure beyond the immediate task. Because the same workflow also writes AKs into code and config paths, accidental session persistence can lead to cross-session leakage, unintended reuse under a different account, or compromise of long-lived API credentials.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

├─ 查文档   ──────────────── baidu-maps-docs MCP
    └─ 写代码（严格四步）
         ① 确定 AK 类型（浏览器端 / 服务端）
         ② 需样式? → style list 先查，无则 style create
         ③ ak list
         ④ 选/建 AK → 写入代码交付
横切：任何命令含「发现新版本」→ 展示更新命令，征得同意后继续

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill instructs copying installed skills, persisting tokens, and reusing configuration within the environment, which can silently extend credential lifetime and exposure beyond the immediate task. Because the same workflow also writes AKs into code and config paths, accidental session persistence can lead to cross-session leakage, unintended reuse under a different account, or compromise of long-lived API credentials.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

├─ 查文档   ──────────────── baidu-maps-docs MCP
    └─ 写代码(严格四步)
         1 确定 AK 类型(浏览器端 / 服务端)
         2 需样式? → style list 先查,无则 style create
         3 ak list
         4 选/建 AK → 写入代码交付
横切:任何命令含「发现新版本」→ 展示更新命令,征得同意后继续

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

bash

# 将路径替换为实际 MCP 配置文件路径
chmod 600 <mcp_config_path>

阶段二：响应用户请求

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

#### 代码类请求（需生成或修改代码/文件）

**JSAPI 版本选择（默认使用 GL 版）**：编写地图前端代码时，**默认使用 BMapGL（GL 版）**，即引用 `https://api.map.baidu.com/api?v=1.0&type=webgl&...`，对象命名空间为 `BMapGL`。**仅当用户明确指定「3.0 版本」或已有代码基于 3.0 时**，才使用 `BMapJS`（v3.0）。两套 API 命名空间不得混用。

写代码前**严格按序**执行下面四步，**禁止跳步或乱序**。