ClawHub
Back to skill

Security audit

Gaode Map Personal - 高德官方个人专属地图 Skill

Security checks for vulnerabilities and agentic risk

Overview

This map skill mostly does what it claims, but it pushes location and itinerary data through extra services and requires map/QR generation more broadly than users may expect.

Review this skill before installing if you will use it with sensitive addresses, trips, customer locations, or private itineraries. It should only generate personal-map QR codes, save image files, or send schema links to QR services when you explicitly want that behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Error
Location
scripts/amap_personal_map_client.py:29
Finding

Personal Map Schema URL Disclosed to an Unrelated Third-Party QR Service

Content
View full analysis

Vulnerability Details

File Location: scripts/amap_personal_map_client.py:18-33 and scripts/amap_personal_map_client.py:590-604
Vulnerability Type: Unauthorized Sensitive Data Disclosure
Risk Level: High

Vulnerable Code

python
def _generate_qr_code_url(schema_url, size="300x300"):
    """
    Generate a QR-code image URL.

    Args:
        schema_url (str): AMap schema link
        size (str): QR-code dimensions

    Returns:
        str: QR-code image URL
    """
    qr_service = "https://api.qrserver.com/v1/create-qr-code/"
    encoded_url = urlparse.quote(schema_url)
    qr_url = "{}?size={}&data={}".format(qr_service, size, encoded_url)

    return qr_url

The personal map request and subsequent disclosure occur here:

python
response = requests.post(
    wia_url,
    params=params,
    json=payload,
    headers=headers,
    timeout=15
)
result = response.json()

if result.get("code") == 1 and result.get("result") == True:
    schema_url = result.get("data", {}).get("schemaUrl", "")
    if schema_url:
        qr_code_url = _generate_qr_code_url(schema_url)

        map_result = {
            "qr_code_url": qr_code_url,
            "lineList": lineList,
            "message": "Personal map QR code generated.",
            "schema_url": schema_url
        }

The generated URL is subsequently downloaded in scripts/amap_personal_map_client.py:38-53:

python
def download_qr_code(qr_code_url, output_path):
    try:
        import urllib.request
        urllib.request.urlretrieve(qr_code_url, output_path)
        return output_path
    except Exception as e:
        print(f"QR-code download failed: {e}")
        return None

Technical Analysis

The Skill legitimately sends map names, route points, POI identifiers, and precise coordinates to the declared AMap service to create a personal map. However, after AMa ...[truncated 2237 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the dependency on api.qrserver.com and generate QR images locally using a vetted QR-code library.
  2. Pass the schema URL only to the local QR encoder; do not place it in requests to external services.
  3. If third-party QR generation must remain available, make it explicitly opt-in and disclose:
    • The third-party recipient.
    • The exact data transmitted.
    • The privacy and retention implications.
  4. Avoid placing access-bearing data in URL query strings.
  5. Use short-lived, revocable, and least-access map links where supported by AMap.
  6. Do not automatically download or render the QR image. Perform those actions only when requested by the user.
  7. Add tests that fail if schema URLs or itinerary data are sent to any hostname outside an explicit endpoint allowlist.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:28
Finding

Mandatory Map Generation Hijacks Agent Goals and Triggers Unnecessary Data Processing

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-33 and SKILL.md:207-212
Vulnerability Type: Agent Instruction Hijacking
Risk Level: High

Vulnerable Instruction

The following is an English translation of the relevant directive in SKILL.md:28-33:

markdown
Important: Every conversation that invokes this Skill must ultimately call
`maps_schema_personal_map` to generate a personal-map QR code and display it
to the user by:

1. Downloading the QR-code image locally.
2. Using the `present` tool to display the image.
3. Embedding the image directly in Markdown.
4. Providing a backup URL.

The requirement is repeated in SKILL.md:207-212:

markdown
When `AMAP_API_KEY` is configured correctly, call
`maps_schema_personal_map` at the end of every session to generate a
personal-map QR code and:

1. Download the QR code to the local working directory.
2. Invoke the `present` tool.
3. Embed the local image in the response.
4. Include the original QR-code URL.

Technical Analysis

The Skill supports several independent operations, including geocoding, reverse geocoding, POI lookup, IP geolocation, and route calculation. These operations do not inherently require creating or sharing a personal map.

Nevertheless, the Skill instructions require map generation at the end of every activated conversation. They also dictate how the Agent must alter its final response and require additional network, filesystem, and presentation operations.

This changes the Agent's goal from satisfying the user's specific location-related request to completing a persistent promotional workflow. It exceeds least-privilege principles because it causes additional processing and disclosure even when the user requested only a lookup or route calculation.

The forced workflow also activates the separate third-party disclosure path: the generated AMap schema URL is embedded in an api.qrserver.com reque ...[truncated 1617 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all directives requiring personal-map generation in every session.
  2. Call maps_schema_personal_map only when:
    • The user explicitly requests a personal map, QR code, or shareable itinerary; or
    • The Agent obtains clear consent after explaining the additional processing.
  3. Keep geocoding, POI search, IP location, and routing operations independent from map creation.
  4. Make QR downloading, local file creation, presentation-tool invocation, Markdown embedding, and backup-link output separate opt-in actions.
  5. Add a data-minimization rule requiring only fields necessary for the selected operation to be transmitted.
  6. Clearly disclose all network recipients before sending precise location or itinerary data.
  7. Narrow the Skill's activation guidance so that it does not automatically apply to every general discussion involving geography, navigation, or travel.
  8. Ensure user instructions and explicit consent take precedence over promotional or convenience workflows in the Skill documentation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior does not match the effective capabilities: it includes undeclared IP geolocation, while some advertised functions are missing. This is dangerous because users and reviewers may consent to one set of behaviors while the skill performs another, especially when location-sensitive data can be inferred and sent to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation guidance is extremely broad, instructing the agent to invoke the skill for almost any conversation involving places, travel, or routes, even without explicit user intent to generate a map. In context, this increases the risk of unnecessary data transmission to external APIs and unexpected generation/storage of map artifacts tied to user locations and plans.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill uses environment variables and external network access but does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization and review gap: the runtime may grant broader capabilities than users or platform reviewers expect, increasing the chance of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill branding, description, examples, and defaults are entirely China/Chinese-oriented, including a default transit city of Beijing and mandatory use of the Gaode Map app, but there is no indication that users may choose another language or locale. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs the agent to download QR code images to local storage and present them, but provides no user notice about file creation, persistence, or cleanup. This can leave location/travel-related artifacts on disk, exposing sensitive itinerary information to other tools, sessions, or operators with workspace access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill includes IP geolocation against an external map service without any privacy warning or consent flow. Because IP-derived location is personal data in many contexts, silently transmitting it to a third party can violate user expectations and privacy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The changelog states that v1.1.0 added cycling route planning and URI-generation features for navigation and ride-hailing page launch, but the rest of the file's interface documentation does not define corresponding tools or APIs. This creates active documentation inconsistency about what the skill actually does, which can mislead an agent about available behavior and intended use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes geocoding, POI search, routing, nearby search, weather, and personal map generation, but it does not mention IP-based location lookup. The demo invokes maps_ip_location, which is a distinct capability that infers location from an IP address rather than from user-provided geographic inputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The demo downloads remote content from a URL and writes it to a fixed local workspace path, creating an unexpected filesystem side effect outside the core map-generation purpose. In an agent environment, this can leave persistent artifacts, overwrite files if names collide, and normalize a pattern of remote-to-local writes that could be abused if the URL or filename source becomes attacker-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code fetches a QR image from a remote URL and writes it to disk without warning or consent, which is a risky side effect for an example likely to be copied into real agent behavior. In interactive or sandboxed environments, silent file writes can violate user expectations, create persistence, and increase exposure to malicious or oversized content delivered from the remote endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The QR code URL is generated via a third-party service, causing the underlying schema link to be sent to api.qrserver.com. That schema may embed sensitive trip or location information, so using an unrelated external QR provider introduces additional unnecessary data exposure beyond the map vendor itself.

Content

Scanner excerpt · scripts/amap_personal_map_client.py (reported line 29)May include surrounding context.

python
str: 二维码图片URL
    """
    # 使用在线二维码生成服务
    qr_service = "https://api.qrserver.com/v1/create-qr-code/"
    encoded_url = urlparse.quote(schema_url)
    qr_url = "{}?size={}&data={}".format(qr_service, size, encoded_url)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The QR download helper writes a file to a caller-specified local path with no user disclosure or path restrictions. While not inherently malicious, silent local writes can surprise users and become unsafe if untrusted input controls the destination path, potentially overwriting files in the agent's workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill transmits user-sensitive data such as addresses, coordinates, search terms, and IP addresses to external map services without any visible disclosure or consent mechanism in the code. In a location-oriented skill this sharing is functionally necessary, but the lack of transparency increases privacy risk because highly sensitive movement and location context may be sent off-platform unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The client implements IP geolocation, which expands the skill from map search/planning into approximate user location inference based on IP address. This is sensitive because users may not expect their IP-derived location to be queried or exposed, and the capability can be used to infer coarse location without explicit consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The code sends structured trip data and map points to an external AMap endpoint to generate a personal map. External transmission is expected for this skill's purpose, but it still presents a real privacy/security concern because itineraries, POIs, and travel plans can reveal sensitive personal patterns if sent without minimization, consent, or contractual controls.

Content

Scanner excerpt · scripts/amap_personal_map_client.py (reported line 590)May include surrounding context.

python
"Content-Type": "application/json"
            }
            
            response = requests.post(wia_url, params=params, json=payload, headers=headers, timeout=15)
            result = response.json()
            
            # 检查响应状态

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill as a '高德个人地图Skill' without indicating any user-selectable language or locale option. Under the natural-language policy rule, this can be a language/locale restriction unless the skill clearly documents that it is region-specific or offers opt-in language choice.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified as requests>=2.25.1, which allows any newer version to be installed, including versions with incompatible behavior or known security issues. In a map skill that makes external HTTP requests, supply-chain unpredictability increases risk because builds may silently resolve to different versions across environments.

Content

Scanner excerpt · requirements.txt (reported line 13)May include surrounding context.

text
#   pip install -r requirements.txt

# HTTP 请求库，用于调用高德地图 API
requests>=2.25.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Because the manifest does not pin requests to a specific patched version, it is impossible to verify whether the installed package is affected by one of the known advisories. This is especially relevant for a skill that interacts with external URLs/APIs, since some requests vulnerabilities can affect credential handling, redirect behavior, or TLS/request validation in networked applications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

User-facing docstrings, status messages, and error messages throughout the file are written in Chinese, with no indication that another language can be selected. For a general-purpose skill, this can violate language/locale policy if users are not given an opt-in or choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The client silently pulls AMAP_API_KEY from the environment, which is a credential-access capability not stated in the manifest. While common for service integrations, it is not directly user-facing and is not justified by the declared functional scope alone.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The main example checks and prints 'schemaUrl' and 'qr_result', but maps_schema_personal_map actually returns 'schema_url' and stores the result in 'result'. This actively misdescribes the code's behavior and would mislead developers about how to consume the function output.

Content

No source excerpt is available for this finding.