ClawHub
Back to skill

Security audit

Amap Settle Guide

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent commute-and-rental helper, but users should be careful with third-party scraping and generated files that may contain map API keys.

Install only if you are comfortable with the agent querying AMap and, when available, scraping rental listing sites for public housing data. Do not use private or unrestricted API keys for generated HTML maps, and avoid sharing generated CSV or HTML files unless you have reviewed them for key values and listing details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill expands from map-based commute analysis into browser-automated scraping of third-party rental platforms using DrissionPage. That adds materially broader capabilities than the declared manifest scope and can cause the agent to interact with external sites, collect unvalidated content, and perform actions subject to site restrictions without explicit user consent or sandboxing expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill instructs scraping of third-party rental sites and producing related links without any privacy, legality, or terms-of-use warning. This increases risk that the agent will collect or reproduce content from sites with anti-bot rules, personal contact details, or usage restrictions, exposing users or operators to compliance and privacy issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill directs the agent to generate CSV and optional HTML files without clearly warning the user that files will be written to the workspace. While not inherently malicious, silent file creation can violate user expectations, clutter the workspace, and create a channel for unintended data persistence or later disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill requires reading API credentials from environment variables and embedding them into HTML without any credential-handling warning. Even if intended for convenience, this normalizes unsafe secret handling and can lead to accidental disclosure of environment-backed keys through generated files, version control, or sharing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to read environment secrets and inject them directly into generated HTML. Embedding secrets into an output artifact can expose credentials to users, logs, downstream sharing, or any recipient of the HTML file, turning a local secret into a distributable client-side token.

Content

No source excerpt is available for this finding.