Security audit

Map RTOS SDK - 高德官方嵌入式地图 SDK Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only SDK integration skill with some privacy and documentation-quality caveats, but I found no hidden execution, persistence, exfiltration, or malicious behavior.

Reasonable to install if you are integrating this specific AMap/WatchSDK RTOS map SDK. Before using generated code, verify it against the actual SDK headers, add explicit location-permission and privacy disclosures, document what device identifiers are sent during activation, and review the noted API/lifecycle inconsistencies rather than copying examples blindly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
| [iOS 集成](api/ios-integration.md) | iOS 平台完整接入指南 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 704)May include surrounding context.
md
| [iOS 集成](api/ios-integration.md) | iOS 平台完整接入指南 |

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document is materially inconsistent with the declared skill: it presents and implements a different 'WatchSDK' with different APIs, identifiers, callbacks, and activation flow instead of the advertised AMap RTOS map SDK. This can cause integrators to embed the wrong binary/interface, send data to an unintended SDK/service, and build against incompatible or unreviewed components, creating supply-chain and security review bypass risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 75% confidence
Finding: SQP-3 适用于所有文件。该 README 全文以中文编写，并在使用示例中仅给出中文触发语和中文交互方式，未说明是否支持其他语言，也未提供用户语言/区域选择，可能构成语言/locale 强制约束。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown trigger section includes generic phrases such as “地图渲染”, “创建地图”, “地图缩放”, and “地图中心点” without limiting them to the AMap RTOS SDK context. These phrases are broad enough to overlap with ordinary mapping or UI-development questions, which may cause unintended invocation of this specific skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The trigger list includes broad terms like “导航”, “轨迹导航”, and “实时导航” with no clarification of when they refer specifically to this embedded SDK rather than general navigation topics. Without narrower scope or negative examples, the skill may activate on everyday navigation-related requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list uses very generic engineering terms such as “adapter”, “适配器”, and “必需函数”, which can apply to many unrelated software contexts. Because the section lacks explicit constraints or exclusions, these terms are likely to collide with ordinary development conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file content is fully presented in Chinese and does not offer any language or locale alternative. Per SQP-3, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document states that map resources are destroyed in deinit, but the shown deinit implementation only logs and does not call destroyMapView or equivalent cleanup. Developers relying on this guidance may ship code that leaks map instances or leaves rendering/native resources alive longer than intended, causing memory/resource exhaustion and unstable behavior over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs use of real location data and observer-based location updates but does not mention requesting user permission, presenting a privacy notice, or handling denied/limited authorization. In an SDK integration guide, this omission can lead adopters to collect or use precise location data without proper consent flow, creating privacy risk and App Store/platform compliance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The sample uses a persistent device identifier and performs network-based activation without disclosing what device/system data may be transmitted or retained. This creates privacy and compliance risk because integrators may unknowingly collect and send stable identifiers, making user tracking or regulatory violations more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language and code example set .area = "mainland" and .country = "cn", which forces a specific locale/region behavior. Under SQP-3, this is a policy concern because the file does not present this as an opt-in choice or justify it as a region-specific tool.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The guide states the SDK is single-threaded and all methods must run on the main thread, but the activation helper does not enforce that contract before calling into the SDK. If callers invoke activation off the main thread, the sample can trigger undefined behavior, race conditions, crashes, or state corruption in a security-sensitive initialization/activation path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document states that first use requires online activation and defines activation parameters including device identifiers and regional settings, but it does not warn users that activation may transmit device or system data over the network. For a markdown skill/API description, safety-relevant network behavior affecting privacy should be disclosed explicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. This document forces a specific language presentation throughout and does not indicate that Chinese is optional, selectable, or required for a justified region-specific reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The entire skill document is written in Chinese and does not indicate any language choice, opt-in, or region-specific justification. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The line-overlay example calls awk_map_bindadd_overlay, while the management section later documents the add API as awk_map_add_overlay. This is an active contradiction in the file's own documentation, not merely an omission, and could mislead developers about the actual function to call.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The polygon example uses awk_map_bindadd_overlay, but the documented management API declares awk_map_add_overlay as the overlay-add function. This creates a direct inconsistency between examples and reference documentation that can cause incorrect integration behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 这是一个 markdown 文件，适用 SQP-2。L148 说明“首次使用需联网激活设备”，意味着技能可能触发网络请求，但文档未对联网行为、可能传输设备信息或激活数据作出显式用户提示。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes a helper for integrating and using the AMap RTOS SDK, covering rendering, overlays, navigation, and adapter implementation. The added Bash command usage for inspecting static library architectures introduces a host-level command execution capability that is not part of the map SDK's core functional scope and is only tangentially related to build troubleshooting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes file-writing, deletion, rename, unzip, and HTTP request adapter functions, but it does not include any user-facing warning about effects on user data, privacy, or system integrity. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that can modify files or transmit data should disclose those risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill documentation is entirely in Chinese and does not offer an alternative language, user opt-in, or a documented justification for a Chinese-only locale constraint. Per the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The cache management section documents a disk-cache clearing function but gives no warning that it deletes persisted local data and may be irreversible. Markdown documentation should disclose destructive or data-affecting behavior so users understand the impact before invoking it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This is a markdown file, so SQP-2 applies to omitted warnings about behaviors affecting privacy or system integrity. The API docs mention tile download callbacks, which imply network access and may involve location-related map tile requests, but the document provides no warning or disclosure about this behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown states that first use requires online activation and shows a call to awk_activate_device, but it does not disclose what device or system data may be transmitted during activation beyond the example fields. For markdown files, safety-relevant behaviors that affect privacy or external connectivity should include a brief user warning.
Content: No source excerpt is available for this finding.