Security audit

Amap Search Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Gaode/AMap command-line mapping skill with expected API calls, but users should handle the API key and location data carefully.

Install only if you are comfortable sending map queries, addresses, coordinates, route endpoints, and IP-derived location data to Gaode/AMap. Prefer AMAP_API_KEY from a secure environment or secret store, avoid putting the key directly after --key in commands, restrict the key in the Gaode console where possible, and rotate it if it has been exposed in shell history or logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gaode_map.py:545
Finding: API Keys Exposed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Location: scripts/gaode_map.py:545-546, scripts/poi_search.py:278, scripts/poi_search.py:283, scripts/poi_search.py:292, and command examples in SKILL.md:56-71
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

scripts/gaode_map.py:545-546:

python
ip_parser = subparsers.add_parser("ip", help="IP location") ip_parser.add_argument("--key", help="Gaode API Key (or set environment variable AMAP_API_KEY)")

The same command-line option is registered for the other subcommands in this file.

scripts/poi_search.py:278, scripts/poi_search.py:283, and scripts/poi_search.py:292:

python
ip_parser.add_argument("--key", required=True, help="Gaode API Key") poi_parser.add_argument("--key", required=True, help="Gaode API Key") geo_parser.add_argument("--key", required=True, help="Gaode API Key")

The documentation instructs users to place the credential directly in the command line:

bash
python3 gaode_map.py ip --key YOUR_API_KEY

Technical Analysis

Both scripts accept the Amap API key as a command-line argument. In scripts/poi_search.py, this method is mandatory because every available subcommand declares --key as required. Although scripts/gaode_map.py also supports the AMAP_API_KEY environment variable, it continues to accept command-line credentials, and the documentation demonstrates that usage.

Command-line arguments are not an appropriate transport for secrets. Depending on the operating system and runtime environment, arguments may be exposed through:

Shell history files.

Process inspection utilities and process metadata.

Job schedulers, automation logs, and command auditing systems.

Terminal recording and observability agents.

CI/CD logs when commands are echoed.

Wrapper scripts or error reports that record the full invocation ...[truncated 1948 chars]
Remediation: View remediation
Remediation Suggestions

Remove or deprecate the --key option in both scripts.

Read the credential from AMAP_API_KEY by default without printing or logging its value.

Add environment-variable support to scripts/poi_search.py, where command-line credential entry is currently mandatory.

If interactive entry is needed, use getpass.getpass() so the key is not echoed or stored in shell history.

Update every example in SKILL.md to use environment-based invocation:

bash
export AMAP_API_KEY="YOUR_API_KEY" python3 gaode_map.py ip

Ensure CI/CD systems provide the key through an encrypted secret store and mask it in logs.

Avoid including complete request URLs in logs because the Amap key is encoded as a URL query parameter.

Configure server-side key restrictions where supported, including API allowlists, quota limits, and source restrictions.

Rotate any key that has previously been entered through a command line or exposed in logs.

If backward compatibility requires temporary support for --key, display a deprecation warning, avoid documenting it, and clearly warn that process arguments and shell history may expose the credential.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents a broad 'all-in-one' Gaode Maps tool with multiple major functions, but the supplied code chunk only supports POI search, nearby search, IP geolocation, and geocoding. There is no implementation for route planning, weather, bus/transit, or traffic. Additionally, the code includes IP location and geocoding features that are not mentioned in the declared description. This is a material description-behavior mismatch because the claimed primary scope is significantly broader and different from what the code actually provides.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
--- AIGC: ContentProducer: Minimax Agent AI ContentPropagator: Minimax Agent AI Label: AIGC ProduceID: 419f142dffc2786f70c781514aae295d PropagateID: 419f142dffc2786f70c781514aae295d ReservedCode1: 3045022100f0a82fe3f70a96ea776cd6f5eb99567be33ce61f08fa12f0e0a9bfb962f853b50220795b188df61cf38c33d2c6326e01946a47ab16c9efc3c5e8195794683bef4a72 ReservedCode2: 30460221009b63253a328bf0551118bab8d26be628665ca7933d06e030f81d5bb83dc879a2022100aab0156baa6ad550357ea8aee375d5211026970299e2fcc89a93df76a1673d21 description: 高德地图全功能工具 - 集成POI搜索、路径规划、天气查询、公交查询、实时路况等。/Gaode Map All-in-One - POI search, route planning, weather, bus, traffic. icon: "\U0001F5FA️" name: amap-search version: 2.0.0 --- # 🗺️ 高德地图全功能工

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
Key 名称 6. 服务平台：勾选 「Web服务」 7. 点击「提交」，获取 Key

💡 免费额度：每个 Key 每天 2000 次调用，个人使用足够

第二步：配置 API Key（推荐使用环境变量）

方式一：设置环境变量（推荐）

bash
# 在终端中设置环境变量 export AMAP_API_KEY="你的API_KEY" # 或在 ~/.bashrc 中永久添加 echo 'export AMAP_API_KEY="你的API_KEY"' >> ~/.bashrc source ~/.bashrc

方式二：命令行参数

bash
python3 gaode_map.py <命令> --key 你的API_KEY [参数]

⚠️ 优先级：环境变量 > 命令行参数。建议使用环境变量，避免每次输入。

📖 详细使用说明

1️⃣ IP定位 (ip)

获取用户当前所在城市。

bash
python3 gaode_map.py ip --key 你的KEY

输出示例：

text
Your location: 四川省成都市 City code: 510100

2️⃣ 地理编码 (geo)

将地址转换为经纬度坐标。

ba

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly documents use of environment variables and outbound API calls, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a trust and governance gap: a host may permit the skill without understanding it needs network access and access to environment-provided secrets, increasing the chance of unintended data exposure or policy bypass.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill offers IP-based geolocation and other map functions that necessarily send location-related data to an external provider, but it does not warn users at the point of use about that disclosure. This can lead users to unknowingly share IP-derived location, addresses, coordinates, routes, and search terms with a third-party service, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The module docstring explicitly documents - bus : Bus/Transit search as an available command, but the argument parser never creates a bus subcommand and the dispatcher never handles one. This is an active contradiction between the file's own usage documentation and runtime behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The tool transmits potentially sensitive user inputs, including IP addresses, precise coordinates, addresses, routes, and search terms, to the external AMap service without any explicit privacy notice or consent flow. In a skill context, users may not realize their location and query data leave the local environment, which can cause inadvertent disclosure of personal or operationally sensitive information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest and module header both claim bus/transit support, including a bus command, but the CLI only implements route transit planning and has no bus subparser or dedicated bus query function. This is a direct mismatch between advertised capability and actual exposed behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The tool sends API keys plus user-supplied IPs, addresses, and location coordinates to a third-party service, but the code provides no user-facing disclosure or consent mechanism. In a skill/agent context, this is more sensitive because users may assume the operation is local, while the tool actually exports potentially private location data to an external provider.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The --location parameter is documented as being for local distance calculation, but in practice it changes behavior to a nearby-search mode and transmits coordinates to the external Amap API. This can cause users or calling agents to disclose precise location data under a misleading interface, increasing privacy risk because sensitive coordinates are sent off-box when the user may expect only local computation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Several docstrings, help strings, comments, and error messages are presented in Chinese, such as the API key guidance and runtime error text. The file does not offer a language selection or document that it is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes POI search, route planning, weather, bus, and traffic, but does not mention reverse geocoding. The code exposes a regeo command that converts coordinates to addresses, which is a distinct user-facing mapping capability rather than a mere implementation detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and CLI description present this script as a 'Gaode Map POI Search Script' / 'POI Search Tool', which suggests a narrower purpose centered on place search. However, the implemented commands also include IP-based location lookup and geocoding, which are distinct map capabilities not reflected in this file's stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The script's natural-language interface is entirely in English, including usage text, help strings, and printed results, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

第二步：配置 API Key（推荐使用环境变量）

📖 详细使用说明

1️⃣ IP定位 (ip)

2️⃣ 地理编码 (geo)

Undeclared Tool Scope

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations

Description-Behavior Mismatch

Description-Behavior Mismatch

Natural-Language Policy Violations

Static analysis