ClawHub
Back to skill

Security audit

Gaode Map CLI - 高德官方命令行工具 Skill

Security checks for vulnerabilities and agentic risk

Overview

This map-control skill is mostly purpose-aligned, but it should be reviewed because its setup can expose AMap API keys and installs an unpinned global npm package.

Install only if you are comfortable with the agent handling AMap API credentials and a global npm package. Before use, remove or avoid commands that print keys, prefer platform-managed secret injection over reading ~/.openclaw/openclaw.json, pin and review the npm package version, and rotate any AMap key that may already have been printed in logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:35
Finding

AMap API Key Exposed Through Standard Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:76
Finding

Mutable Dependency Installed Globally Without Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This code path explicitly loads AMAP_KEY from a local configuration file using Node and places it into the process environment. Reading credentials from disk on behalf of the agent is credential-access behavior and increases exposure of sensitive data to logs, subprocesses, and any subsequent command execution in the same shell.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
if [ -f "$CONFIG_FILE" ]; then
    AMAP_KEY=$(node -e "
      const c = require('$CONFIG_FILE');
      const env = c?.skills?.entries?.['amap-cli-skill']?.env || {};
      console.log(env.AMAP_KEY || '');
    " 2>/dev/null)
    AMAP_SECURITY_KEY=$(node -e "

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This code similarly extracts AMAP_SECURITY_KEY from local configuration and exports it for later use. Security keys are sensitive credentials; retrieving them from disk and broadening their availability to the shell and child processes materially increases the chance of leakage or misuse.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
" 2>/dev/null)
    AMAP_SECURITY_KEY=$(node -e "
      const c = require('$CONFIG_FILE');
      const env = c?.skills?.entries?.['amap-cli-skill']?.env || {};
      console.log(env.AMAP_SECURITY_KEY || '');
    " 2>/dev/null)
    export AMAP_KEY

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The display name and description are entirely in Chinese and present the skill as operating in that language, while the document never offers an alternate language or asks for user preference. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to read API secrets directly from a local OpenClaw configuration file and export them into the current shell. That expands the skill's scope from map control into credential retrieval from disk, which violates least privilege and creates a path for unintended secret access if the skill or downstream commands are compromised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation contradicts itself by saying environment injection should exist while also directing the agent to bypass that mechanism by reading secrets from disk. This inconsistency encourages unsafe fallback behavior and normalizes secret scraping as part of standard execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.