ClawHub
Back to skill

Security audit

调用百度地图api功能

Security checks for vulnerabilities and agentic risk

Overview

This Baidu Maps skill is mostly coherent, but it shares sensitive location data with Baidu and documents unsafe shell command patterns for user-supplied input.

Review before installing. Use this skill only if you are comfortable sending map searches, addresses, coordinates, route endpoints, and IP lookup data to Baidu. Agents should not paste raw user text into the documented shell commands; they should use a structured HTTP client or curl with parameter-safe URL encoding, and the Baidu access key should be restricted by API, quota, and allowed usage where possible.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:40
Finding

Shell Command Injection Through Unsafe User-Controlled URL Substitution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Documenting IP-based geolocation without any privacy warning is risky because IP-derived location can reveal coarse user location and may be collected or inferred without the user understanding that this processing occurs. In a location-services skill, this is more dangerous because users may not realize network identifiers are being used to infer location through a third party.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Saying the system will automatically use the map API for location-related requests is overly broad and lacks explicit trigger boundaries, which can cause the skill to activate on ambiguous prompts and send sensitive location-related content externally without clear user intent. In an agent ecosystem, vague activation language increases the chance of unintended tool invocation and privacy-impacting data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README says the system can automatically handle location-related requests but does not warn that user queries and possibly location data will be transmitted to Baidu's external API. This creates a meaningful transparency and privacy issue, as users may disclose addresses, coordinates, or routing destinations without realizing the data leaves the local system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill repeatedly instructs sending user-supplied addresses, coordinates, routes, and IP addresses to Baidu's external API, but it does not clearly warn that this data leaves the local environment and is processed by a third party. This creates a real privacy and data-handling risk, especially because location and IP data can be sensitive personal information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example sends user search terms to an external Baidu endpoint over the network. While expected for a mapping skill, it is still a real external transmission of potentially sensitive user-provided location interests without any nearby disclosure or consent language.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
# 将 [关键词] 替换为用户提供的内容
# region参数可以是城市名或区域名
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]&region=全国&output=json&ak=$BAIDU_MAP_AK"

# 或者指定具体城市
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]&region=广州&output=json&ak=$BAIDU_MAP_AK"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example transmits user search input and region information to Baidu's API. Even though the transmission is core to the skill's purpose, it can still expose user interests or location context to a third party if used without clear disclosure.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

curl "https://api.map.baidu.com/place/v2/search?query=[关键词]&region=全国&output=json&ak=$BAIDU_MAP_AK"

或者指定具体城市

curl "https://api.map.baidu.com/place/v2/search?query=[关键词]&region=广州&output=json&ak=$BAIDU_MAP_AK"

text

### 2. 城市内地点搜索

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This call sends both a keyword and a city value derived from user input to an external service. Combining search intent with a specific city increases privacy sensitivity because it can reveal where a user lives, travels, or seeks services.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash
# 将 [关键词] 和 [城市] 替换为实际内容
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]&region=[城市]&output=json&ak=$BAIDU_MAP_AK"

3. 周边搜索 (圆形区域内搜索)

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This example transmits precise latitude/longitude coordinates to Baidu for nearby search, which is materially sensitive location data. Disclosure of exact coordinates can reveal home, workplace, or real-time whereabouts, making this more dangerous than generic search examples.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash
# 将 [经度,纬度] 替换为实际坐标，radius为搜索半径(米)
curl "https://api.map.baidu.com/place/v2/search?query=花店&location=[纬度],[经度]&radius=1000&output=json&ak=$BAIDU_MAP_AK"

4. 地理编码 (地址 → 坐标)

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Geocoding sends a user-provided address to a third-party API, which may expose home, work, or other sensitive locations. Because street addresses are directly identifying, this external transmission has meaningful privacy implications.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash
# 将 [地址] 替换为用户提供的地址
curl "https://api.map.baidu.com/geocoding/v3/?address=[地址]&output=json&ak=$BAIDU_MAP_AK"

5. 逆地理编码 (坐标 → 地址)

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

Reverse geocoding sends precise coordinates to an external service and retrieves a structured address, potentially converting approximate location context into directly identifying information. This increases privacy risk because exact coordinates can map to a residence or other sensitive place.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# 将 [经度,纬度] 替换为实际坐标
curl "https://api.map.baidu.com/reverse_geocoding/v3/?coordtype=wgs84ll&location=[纬度],[经度]&output=json&ak=$BAIDU_MAP_AK"

6. 驾车路线规划

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Route planning transmits origin and destination values to Baidu, which can reveal movement patterns, commuting behavior, or visits to sensitive locations. Sending both endpoints together creates a richer and more invasive data disclosure than a single-place lookup.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

bash
# 将 [起点] 和 [终点] 替换为实际地址或坐标
# 起终点可以用地址表示，也可以用经纬度表示
curl "https://api.map.baidu.com/direction/v2/driving?origin=[起点]&destination=[终点]&output=json&ak=$BAIDU_MAP_AK"

# 使用经纬度坐标的示例
curl "https://api.map.baidu.com/direction/v2/driving?origin=39.90923,116.397428&destination=31.230416,121.473701&output=json&ak=$BAIDU_MAP_AK"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Although this line uses hard-coded example coordinates rather than direct user input, it still demonstrates transmission of precise location data to a third-party service. The privacy risk is lower than dynamic personal data, but the pattern normalizes sensitive external location sharing without warning.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Walking route queries send origin and destination information externally, potentially exposing detailed personal movement plans. In many contexts, this may reveal sensitive places such as home, medical facilities, schools, or workplaces.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

bash
# 将 [起点] 和 [终点] 替换为实际地址或坐标
curl "https://api.map.baidu.com/direction/v2/walking?origin=[起点]&destination=[终点]&output=json&ak=$BAIDU_MAP_AK"

8. 公交路线规划

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

Transit route planning shares user route endpoints with Baidu, which can expose travel habits and sensitive location pairs. The skill context makes this transmission expected, but not harmless, because it still involves third-party processing of potentially personal location data.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash
# 将 [起点] 和 [终点] 替换为实际地址或坐标
curl "https://api.map.baidu.com/direction/v2/transit?origin=[起点]&destination=[终点]&output=json&ak=$BAIDU_MAP_AK"

9. 行政区划边界查询

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

bash
# 将 [行政区名称] 替换为实际的省市区名称
curl "https://api.map.baidu.com/district/v1/getdistrict?qt=dis&level=city&names=[行政区名称]&ak=$BAIDU_MAP_AK"

10. IP定位

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The IP-location example sends an IP address to a third-party service and even notes that omitting the parameter may use the current client IP. IP addresses are personal data in many jurisdictions and can reveal approximate location and network identity, making this a significant privacy issue without explicit warning and consent.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

bash
# 将 [IP地址] 替换为实际IP，若不提供则使用当前客户端IP
curl "https://api.map.baidu.com/location/ip?ip=[IP地址]&ak=$BAIDU_MAP_AK"

使用技巧

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description says the skill provides place search, weather queries, route planning, and geocoding. The README additionally advertises administrative division queries and IP-based geolocation, which expands the documented behavior beyond the stated manifest scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language instructions, triggers, and usage guidance are entirely in Chinese, which can impose a language constraint on users without any opt-in or explanation. The policy allows locale-specific behavior when it is explicitly documented and justified, but this file does not state that the skill is intended only for Chinese-speaking users or offer alternatives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.