ClawHub
Back to skill

Security audit

调用百度地图api功能

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Baidu Maps API helper; it sends map-related queries to Baidu and needs privacy-conscious use, but the behavior matches its purpose.

Install this only if you are comfortable with map queries, addresses, coordinates, route endpoints, and any requested IP addresses being sent to Baidu Maps. Treat BAIDU_MAP_AK as a secret, avoid logging or sharing it, and avoid IP-based location unless the user explicitly asks for it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The declared skill scope says the skill is for place search, weather, route planning, and geocoding, but the body also includes administrative boundary lookup and IP geolocation. Undisclosed capabilities expand what data can be queried and transmitted, making review, consent, and policy enforcement less reliable.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
IP geolocation is materially more privacy-sensitive than ordinary map search or route planning because it can infer a user's approximate location from network data. Including it in a broadly described mapping skill without explicit justification increases the risk of collecting or transmitting sensitive location-related information beyond user expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README says the system will automatically use Baidu Map APIs for location-related requests but does not warn that user queries, addresses, coordinates, or IP-derived location data may be transmitted to a third-party service. In a mapping skill, this omission is security-relevant because it can lead to unintended disclosure of sensitive location information without informed user awareness or operator review.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs sending user-provided addresses, coordinates, locations, and possibly IP addresses to Baidu's web APIs, but it does not warn users that this information will be shared with a third party. This creates a privacy and compliance risk, especially for sensitive location data that can reveal home, work, travel patterns, or approximate physical presence.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.