ClawHub
Back to skill

Security audit

腾讯地图api调用技能

Security checks across malware telemetry and agentic risk

Overview

This Tencent Maps skill is a straightforward map API helper with expected network and API-key use, but users should understand that their map queries and location data go to Tencent.

Install only if you are comfortable sending map searches, addresses, and coordinates to Tencent Maps using your own API key. Keep the key secret, prefer a restricted or rotatable key, monitor quota usage, avoid sensitive locations, and note that the documented route command is not actually implemented in the current script.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Low
Confidence
71% confidence
Finding
The skill instructs users to export an API key but provides no guidance on keeping the credential secret, avoiding logs, or preventing accidental disclosure. In agent and shell-based environments, users may paste commands into shared terminals, transcripts, or CI logs, increasing the risk of credential exposure and unauthorized API usage.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list is broad enough to match many ordinary map-related requests, which can cause the skill to activate in situations where the user did not explicitly intend to use this integration. Because the skill has network access and can use an API key, overbroad activation increases the chance of unnecessary external requests and unintended disclosure of user queries to Tencent's service.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The manifest explicitly enables network access and use of the TENCENT_MAP_KEY environment secret, but it provides no user-facing disclosure about external data transmission or secret-backed API usage. This is risky because user queries, coordinates, or addresses may be sent to a third-party provider without clear notice, creating privacy and trust concerns even if the integration is functionally legitimate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.