Security audit

.Gaodemapskill.Conflict

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Gaode/AMap helper that uses an API key and sends map queries to AMap, with some security hygiene issues but no hidden or purpose-mismatched behavior.

Install only if you are comfortable sending searches, addresses, and route endpoints to Gaode/AMap. Prefer setting AMAP_API_KEY through a protected environment or secret manager, avoid using --key on the command line, and consider pinning requests before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependency Enables Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: amap_tool.py:15
Finding: AMap API Key May Be Disclosed Through Unsanitized HTTP Error Output
Content: View full analysis
`, returning `str(e)` can copy the credential into the JSON result. The JSON result is printed to standard output, which may be retained in agent transcripts, application log ...[truncated 1442 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: amap_tool.py:112
Finding: API Credential Accepted Through an Exposed Command-Line Argument
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes a Python script that uses both an environment secret (AMAP_API_KEY) and network access, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens security boundaries because an agent runtime may grant broader capabilities than necessary or fail to present clear consent/audit controls for secret and network usage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill sends user-supplied search terms and optional city/location data to the external AMap API without any built-in notice, consent flow, or minimization controls. Even though this is required for the feature to work, location and place queries can be sensitive personal data, so silent transmission creates a privacy risk for users who may not realize their inputs leave the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Route planning and geocoding transmit origin, destination, and possibly city data to a third-party mapping provider, which can reveal highly sensitive movement or address information. The code performs this automatically when inputs are not coordinates, with no explicit warning that personal location data will be disclosed externally.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The dependency manifest includes requests without a pinned version, which makes builds non-reproducible and can cause different environments to install different releases, including vulnerable or breaking ones. In a skill that interacts with an external map service over the network, using an unpinned HTTP client increases supply-chain and reliability risk, even though this file alone does not prove active exploitation.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The manifest does not pin the version of requests, so it is impossible to verify whether the installed release is affected by known advisories. Because this skill likely performs outbound HTTP requests to Gaode Map services, an outdated or vulnerable requests version could expose credentials, TLS/session behavior, or other network-handling weaknesses depending on runtime resolution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.