ClawHub
Back to skill

Security audit

Map Agent - Android LLM Agent SDK（高德官方 AI Agent Skill）

Security checks for vulnerabilities and agentic risk

Overview

This appears to be legitimate AMap Android integration documentation, but it needs Review because it guides continuous location sharing, app control, raw logging, and dynamic SDK dependencies without enough safety scoping.

Install only if you are prepared to review generated Android code carefully. Require explicit user consent and runtime permissions before collecting or sharing location, avoid passive or global voice-command activation, add confirmations for navigation-changing actions, pin SDK versions, and remove or redact sensitive production logs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
api/quick-start.md:10
Finding

Unpinned Dynamic SDK Dependencies Permit Unreviewed Supply-Chain Changes

Content
View full analysis

Vulnerability Details

File Location: api/quick-start.md:10-19
Additional Locations: SKILL.md:62-68, README.md:72-78, README_zh.md:72-78
Vulnerability Type: Dynamic dependency version resolution
Risk Level: Medium

Vulnerable Code

gradle
dependencies {
    // LLM Agent SDK
    implementation 'com.amap.lbs.client:amap-agent:1.1.41'
    
    // Navigation SDK (required)
    implementation 'com.amap.api:navi-3dmap:latest.integration'
    
    // Location SDK (required for real-time location updates)
    implementation 'com.amap.api:location:latest.integration'
}

Technical Analysis

The navigation and location SDK dependencies use the dynamic version selector latest.integration. Unlike the explicitly pinned Agent SDK version, these selectors allow Gradle to resolve a different artifact over time without any source change or explicit review.

This makes builds non-reproducible and weakens supply-chain controls. A newly published, compromised, or incompatible artifact can be incorporated automatically during a clean build or dependency refresh. The risk is elevated because these SDKs operate inside an Android application that may possess network and precise-location permissions.

Exploitation requires an attacker to control or compromise an artifact, repository, publishing account, or dependency-resolution source from which Gradle resolves these coordinates. The documentation does not itself retrieve a known malicious package, so this finding represents an unsafe dependency practice rather than evidence that the current SDK is malicious.

Attack Path

  1. A developer follows the integration guide and adds the dynamic dependencies.
  2. An attacker compromises an authorized package publication channel or repository, or otherwise causes a malicious newer artifact to be returned for one of the coordinates.
  3. A clean build or dependency refresh resolves latest.integration ...[truncated 799 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace each latest.integration selector with an exact, reviewed release version.
  2. Enable Gradle dependency locking and commit the generated lock files.
  3. Enable Gradle dependency verification with trusted checksums or signatures.
  4. Restrict dependency resolution to explicitly approved official HTTPS repositories.
  5. Reject dynamic and changing dependency versions in CI.
  6. Review release notes and security changes before deliberately upgrading each SDK.
  7. Use a controlled internal artifact mirror if SDK packages are distributed outside a standard repository.
  8. Generate and monitor a software bill of materials for released applications.

T09 · Insecure Skill Coding Practices

Warning
Location
api/logger.md:8
Finding

Sensitive SDK, Session, and Query Data Is Written to Android Logs Without Redaction

Content
View full analysis

Vulnerability Details

File Location: api/logger.md:8-30
Additional Locations: api/quick-start.md:172-199, api/query-result.md:20-28, api/agent-query.md:27-28, references/troubleshooting.md:31-36, api/link-client.md:55-66
Vulnerability Type: Sensitive information exposure through application logs
Risk Level: Medium

Vulnerable Code

java
mAMapContext.setLogger(new ILogger() {
    @Override
    public void onLog(int level, String msg) {
        switch (level) {
            case LOG_LEVEL_DEBUG:
                Log.d(TAG, msg);
                break;
            case LOG_LEVEL_INFO:
                Log.i(TAG, msg);
                break;
            case LOG_LEVEL_WARN:
                Log.w(TAG, msg);
                break;
            case LOG_LEVEL_ERROR:
                Log.e(TAG, msg);
                break;
            case LOG_LEVEL_FATAL:
                Log.wtf(TAG, msg);
                break;
            case LOG_LEVEL_TRACK:
                Log.i(TAG, "[TRACK] " + msg);
                break;
        }
    }
});

Query results and identifiers are also logged directly:

java
if (result.errorCode != 0) {
    Log.e(TAG, "Query error: " + result.errorCode + " - " + result.errorMessage);
    return;
}

if (result.summary != null && !result.summary.isEmpty()) {
    Log.d(TAG, "Summary: " + result.summary);
}
java
Log.d(TAG, "Error code: " + result.errorCode);
Log.d(TAG, "Error message: " + result.errorMessage);
Log.d(TAG, "Session ID: " + result.sessionId);
Log.d(TAG, "Action type: " + result.actionType);

Technical Analysis

The recommended logger forwards unrestricted SDK messages to Android logging APIs at every severity level. Separate examples explicitly log query summaries, error details, session identifiers, and operational result data.

SDK messages and query summaries may contain ...[truncated 2041 chars]

Remediation
View remediation

Remediation Suggestions

  1. Disable debug, informational, tracking, and verbose SDK logging in release builds.
  2. Do not log query text, query summaries, precise coordinates, route details, complete callback objects, or session and task identifiers.
  3. Redact sensitive values before logging, using an explicit allowlist of safe fields rather than a blacklist.
  4. Replace raw identifiers with non-reversible, short-lived diagnostic correlation values where troubleshooting requires correlation.
  5. Avoid forwarding unrestricted SDK messages directly to logcat or remote telemetry.
  6. Apply production log retention limits and access controls to support bundles and telemetry systems.
  7. Ensure exception and error messages are sanitized because upstream SDK messages may include request context.
  8. Add automated checks that reject sensitive logging calls and verify that release builds remove debug logging.
  9. Document that full diagnostic logging may only be enabled temporarily with informed user consent and must be disabled after troubleshooting.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Generic commands like '第二个' and '是的' are highly collision-prone because they commonly appear in normal conversation and can directly confirm selections or trigger navigation. In a map/navigation context, accidental recognition could start routing, change a destination, or confirm an unsafe action while the user is distracted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README promotes natural-language queries and cross-app communication with the AMap app but does not warn developers that user inputs, location data, routes, and other context may be transmitted over the network or shared with another app. In an Android integration skill, that omission can cause downstream apps to implement sensitive features without adequate disclosure, consent flow, or data-handling review, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes LinkClient-based cross-application communication and data sharing with the Amap app but does not warn about privacy, permission, or data-minimization considerations. In an AI-agent integration context, this omission can lead developers to implement inter-app data flows without informed consent handling, permission review, or clear disclosure of what user location/navigation data may be shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill describes handling voice/text queries, real-time location updates, and communication with the AMap app, but it does not present any privacy notice, consent guidance, or data-sharing explanation to users or integrators. In a location-enabled assistant context, this omission can lead to silent collection or transmission of sensitive personal and location data without clear user awareness, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file explicitly defines trigger phrases, so SQP-1 applies. Among the listed triggers, "接入Agent" is generic and lacks product or SDK specificity, making it unclear when this skill should activate instead of other agent- or SDK-related skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file presents all instructions and code-context guidance exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly promotes data synchronization and remote control of the AMap app but does not warn developers about user consent, privacy exposure, authentication state, or the system-impact of issuing navigation/control actions to another app. In an SDK guide for natural-language map control, this omission can lead integrators to implement sensitive cross-app control flows without adequate disclosure, authorization checks, or safe UX constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation encourages enabling SDK logging, performance tracking, and multi-path sending but does not warn developers that logs and telemetry may contain sensitive user data such as queries, location-related context, device identifiers, or operational metadata. In a map/navigation SDK, those signals are privacy-sensitive, so presenting these features without disclosure, minimization guidance, or environment restrictions can lead to unintended data exposure or over-collection in production apps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all instructions, headings, and field descriptions only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guidance explicitly instructs developers to collect continuous real-time location data and forward it to the Agent SDK, but it does not clearly require runtime permission handling, explicit user consent, or a user-facing privacy notice before enabling tracking. In a navigation/LLM assistant context, this can lead to over-collection and undisclosed sharing of precise location, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill documentation is presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document title and all user-facing troubleshooting guidance are written in Chinese, and the file does not indicate that the skill is region-specific or provide any user opt-in for language/locale. This can violate a language/locale policy when users are not given a choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing command examples and headings are presented exclusively in Chinese, with no indication that other languages are supported or that Chinese is an optional locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples for search and nearby queries use broad everyday phrases such as asking to find parking or gas stations without any visible wake-word, push-to-talk, or confirmation constraints. In a voice-driven navigation assistant, this can cause unintended actions or data queries from incidental speech, especially in-car where background conversation is common.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

A language/locale policy concern exists when a skill or its instructions effectively force a single language without offering alternatives or documenting a justified locale restriction. This file presents all user-facing instructional content only in Chinese and does not state that the skill is China-specific or provide a language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该 Markdown 文档以中文呈现核心说明，但未说明这是面向特定中文用户群体或区域场景的限定，也未提供可选语言或用户选择机制。根据语言/地区政策要求，若技能内容默认强制单一语言且无用户选择，可能构成自然语言层面的策略不合规。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.