经纬度位置查询 - 即刻数据

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.1

Overview

This skill does the advertised reverse-geocoding task and does not show hidden or unrelated behavior.

Install only if you are comfortable sending queried coordinates and your Jike API key-authenticated request to jikeapi.cn. Treat precise coordinates as potentially personal location data, keep the API key private, and leave JIKE_API_BASE_URL unset unless you intentionally trust an alternate endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill sends user-provided coordinates to a third-party API but does not prominently warn users that this location data leaves the local environment. Coordinates can be sensitive personal data because they may reveal a person's home, workplace, or real-time whereabouts, so undisclosed transmission creates a privacy risk and undermines informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.