T09 · Insecure Skill Coding Practices
Warning
- Location
api/authorization.md:62- Finding
Persistent Local Boolean Is Used as Proof of IPC Authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
Map Agent - iOS LLM Agent SDK（高德官方 AI Agent Skill）
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate AMap iOS SDK integration skill, but it needs review because its templates handle location, navigation, IPC, and logs without enough safety and privacy guardrails.
Install only for projects that intentionally integrate AMap MALLMKit. Treat the generated code as sample material: add explicit user consent for location use and route-changing commands, avoid untrusted custom Agent URLs, redact or disable raw logs in production, and revalidate IPC authorization instead of relying on NSUserDefaults.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
api/integrate-agent.md:112- Finding
Sensitive Agent and IPC Data Is Logged Without Redaction or Release Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly advertises authorization, IPC link establishment, and data send/receive with the AMap app but provides no warning that app-to-app communication and transmitted data may have privacy, security, or behavioral effects. In this context, omission of those warnings can mislead users into enabling sensitive flows without understanding what is shared, what permissions are involved, or what commands may be executed across the IPC channel.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The alias trigger phrases are broad enough to catch generic support or integration requests such as '接入agent sdk' or 'IPC通信', which can cause the skill to activate outside the user's precise intent. In a skill that covers SDK integration, authorization, and app-to-app IPC, unintended activation can steer users into sensitive implementation guidance they did not explicitly request, increasing the risk of misrouting and unsafe action suggestions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation instructs developers to send free-form natural-language user queries to an agent service but does not warn that user-entered content may leave the device or be processed by backend AI services. This creates a privacy and data-handling risk because developers may unknowingly transmit sensitive location intents, destinations, or personal information without consent, disclosure, or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file documents overriding the agent service URL with an arbitrary custom endpoint, but provides no warning that all natural-language queries may then be routed to third-party infrastructure. In this skill's map/agent context, those queries can reveal highly sensitive location plans and movement intent, so silent redirection materially increases privacy, compliance, and data-exfiltration risk.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
前置条件
- 已在 Info.plist 中配置 URL Scheme 和
LSApplicationQueriesSchemes（详见 quick-start.md） - 已导入头文件：
objc #import <MALLMKit/AMapAuthorizationManager.h>- 已在 Info.plist 中配置 URL Scheme 和
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation explicitly describes sending JSON commands and location-bearing POI/navigation data over IPC to the AMap app, but it does not warn integrators that user location, destination, and route-control actions are being transmitted to another application. In an agent/LLM context, this omission is risky because downstream developers may invoke these capabilities without surfacing consent, notice, or appropriate privacy controls to end users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented commands can directly alter live navigation behavior by adding waypoints, changing destinations, and modifying broadcast settings, yet the documentation does not warn about user impact or recommend confirmation before issuing such actions. In an agent-driven integration, this can lead to silent or unexpected route manipulation, confusing or unsafe user experiences, and abuse if an LLM or calling component triggers commands without explicit user approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The query callback logs agent summaries and session IDs, which may expose user intent, route/search content, and correlatable identifiers to local logs or external logging pipelines. In a map assistant context this is especially sensitive because queries may reveal destinations, habits, and travel context, yet the sample provides no warning or redaction guidance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The sample hard-codes a specific vehicle identifier ("京DFZ588") into the navigation environment even though a map/route-planning integration example does not require real vehicle identity data. This creates unnecessary exposure of potentially sensitive personal or organizational information and encourages downstream developers to embed real identifiers in source code, logs, or test builds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example begins location updates as part of initialization without any user-facing disclosure in the skill text about continuous location collection, purpose, retention, or consent expectations beyond OS permission prompts. Because this is a navigation SDK integration skill, the behavior is contextually relevant, but the omission still risks developers shipping privacy-sensitive tracking flows without adequate notice or minimization.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The sample destroys global singleton managers in viewDidDisappear while the note says they usually should not be destroyed on page teardown. In an app using these shared managers across screens, this inconsistency can cause availability and state integrity problems, including broken navigation sessions, unexpected reinitialization, or race conditions if other components still depend on the singletons.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill documentation is written only in Chinese and does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation example forwards raw SDK log content directly to NSLog without any sanitization, filtering, or warning that logs may contain sensitive data such as user queries, location details, tokens, identifiers, or IPC/debug context. In a map/agent SDK, logs are especially likely to include privacy-sensitive telemetry, so encouraging unconditional logging can lead to exposure in device logs, crash reports, shared debug output, or downstream log collection systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation encourages registering real-time navigation data listeners and describes callbacks carrying raw PB data, typed result objects, and navigation/location updates, but it does not warn that these callbacks may include sensitive location, route, and travel-behavior information. In an agent/SDK context with IPC to a map app, developers may log, persist, or forward this data without applying minimization, consent, or retention controls, increasing privacy and data-exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all user-facing instructions and examples exclusively in Chinese, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-only audience. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document title and description are entirely in Chinese, and there is no indication that language selection is optional or that the skill is intentionally region-specific. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file presents all troubleshooting guidance exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in can be a policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guidance says the SDK supports broad natural-language expressions and will automatically infer user intent, which can increase the chance of accidental or ambiguous invocation of sensitive map actions such as route changes or navigation exit. In a driving/navigation context, over-broad trigger handling is more dangerous than in a low-stakes assistant because unintended execution can distract the user or alter navigation state at the wrong time.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language content in this file is entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains user-facing instructional content only in Chinese, and there is no indication that language selection is optional or that the locale restriction is justified. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern.
- Content