Gaode

Security checks across malware telemetry and agentic risk

Overview

This Gaode Maps helper is mostly coherent, but it includes automation guidance that appears to encourage avoiding human-verification checks.

Review before installing. Use only for low-volume, user-directed Gaode/Amap tasks, avoid sensitive private locations unless intended, and do not use the skill to bypass CAPTCHA or other human-verification controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The description says the skill should be invoked whenever access or automation of Gaode-related content is needed, which is a broad trigger that can cause over-invocation outside narrowly scoped user intent. Overly broad activation increases the chance an agent uses this skill for unintended browsing or data collection workflows, especially since the skill includes automation guidance around POI extraction and route scraping.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal