Security audit

MapV Three（百度地图官方3D地图SKills）

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only MapV-Three GIS skill whose sensitive examples are mostly expected for web mapping work, but users should handle API keys, location data, HTML overlays, and editing examples carefully.

Before installing, be comfortable with Chinese-language docs and with GIS examples that may contact external map or data providers. Keep Baidu/Mapbox/Cesium/Tianditu tokens in secure configuration, avoid pasting real bearer tokens into source, sanitize any untrusted text before rendering HTML overlays or popups, and use explicit authorization and confirmations before adapting the map editing/delete APIs for production data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (55)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
- `references/measure.md` - Measure 测量工具

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language content throughout the file is presented in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 该 markdown 文件适用 SQP-2。此处介绍了高精地图元素编辑功能，包括添加、更新和删除元素，这些操作会修改后端数据或地图内容，但文档只说明了接口与用法，没有提醒用户这些操作可能造成数据变更、需要权限控制或建议在生产环境谨慎使用。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document title and the entire skill content are presented only in Chinese, which imposes a specific language choice on users. Under the stated policy, locale or language constraints should either be optional for the user or clearly documented as justified for a region-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: All user-facing instructional content in this skill file is presented only in Chinese, and the document does not indicate that this locale restriction is optional or region-specific. Per SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/datasource/json-datasource.md (reported line 129)May include surrounding context.
md
}); // 加载 API 数据 const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/points', { parseCoordinates: (item) => ({ type: 'Point', coordinates: [item.location.longitude, item.location.latitude]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/datasource/json-datasource.md (reported line 169)May include surrounding context.
md
}); // 加载 API 数据 const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/points', { parseCoordinates: (item) => ({ type: 'Point', coordinates: [item.location.longitude, item.location.latitude]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation includes an example that sends an Authorization bearer token to a remote HTTPS endpoint without any warning about outbound network access, credential handling, or trust boundaries. In a developer-facing skill, this can normalize copying example code that transmits secrets to third-party services, increasing the risk of accidental credential exposure or unintended external data transfer.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This example explicitly demonstrates attaching an Authorization header with a bearer token to a remote request, but provides no warning about secret handling or the risk of sending credentials to external endpoints. In documentation for a data-loading API, this materially increases the chance that users will paste real tokens into sample code and transmit them to untrusted or misconfigured services.
Content: Scanner excerpt · references/datasource/json-datasource.md (reported line 427)May include surrounding context.
Q: 从 URL 加载时如何传递请求头？

javascript
const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/data', {}, { headers: { 'Authorization': 'Bearer token', 'Accept': 'application/json'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and the entire document are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The DOMPoint example builds HTML with template literals and assigns untrusted data fields directly into innerHTML. If developers copy this pattern and the name or description fields come from user-controlled or external data, it can lead to DOM-based XSS and arbitrary script execution in the browser.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation example injects data into innerHTML without any warning about HTML or script injection risks. In a Web-GIS skill, DOMPoint is specifically intended for custom interactive HTML overlays, so unsafe example code is especially likely to be reused in production and can expose applications to XSS.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Line L032 explicitly instructs users to call start() to resume playback, but the surrounding lifecycle documentation at L027-L029 defines the operational methods as track(), pause(), and stop(). This is an active contradiction in the file's own API guidance, not merely an omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s instructional content is written entirely in Chinese, including the title and all usage guidance, with no indication that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a natural-language locale policy concern because it imposes a specific language by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly demonstrates assigning raw HTML strings to popup.title and popup.content without any warning or sanitization guidance. If developers pass untrusted data into these properties and the component renders via innerHTML or equivalent, this creates a straightforward DOM-based XSS path in a Web-GIS application.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation promotes geocoding, POI search, and route-planning against external providers but does not warn that user-entered addresses, keywords, and coordinates may be transmitted to Baidu Maps or Tianditu. In a GIS/web-mapping skill, these inputs can contain sensitive location data, so omission of data-sharing/privacy guidance can cause developers to unknowingly exfiltrate user data to third parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file includes an example that connects to a WebSocket server and transmits/receives live vehicle tracking data, which can affect privacy and expose operational data. The surrounding documentation does not provide any warning or disclosure about handling sensitive location/telemetry data or securing the connection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file declares a required credential (BMAP_JSAPI_KEY) in the manifest header, but the user-facing description contains no warning or guidance about supplying, storing, or protecting that secret. For markdown files, omissions around behaviors affecting privacy or system integrity should be flagged when the skill relies on sensitive credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: SQP-3 适用于所有文件。该技能文档全文仅以中文呈现，未提供多语言选项、用户语言选择机制，亦未说明这是面向特定中文用户群或地区的限定文档，可能构成未经说明的语言/locale 限制。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: 该文件多处说明会从远程 URL、Cesium Ion 或自定义 apiHost 加载数据，其中 TrafficMap3DTiles 还会每 60 秒自动轮询接口。文档没有明确提醒这些功能会持续发起网络请求并向外部服务传输地图查询上下文，可能影响隐私、流量或系统行为可预期性。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents the skill documentation entirely in Chinese, including headings and explanatory text, with no indication that users may choose another language or that the skill is region-specific. Under the policy category, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill document is written in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional for a region-specific use case. Under the policy rule for natural-language violations, this can be considered a language/locale constraint without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file’s instructional content is entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a justified region-specific requirement. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file contains only Chinese-language headings, descriptions, and examples, which can constitute a language/locale policy issue when users are not given an opt-in or alternative language. There is no indication that the skill is intentionally region-specific or that users can choose another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file is written entirely in Chinese, including the title and all usage guidance, with no indication that users may choose another language or that the documentation is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.