ClawHub
Back to skill

Security audit

Amap Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Gaode/Amap map CLI that sends map queries to Amap when used, with no hidden execution, backdoor, or unrelated data collection found.

Install only if you are comfortable sending your map searches, addresses, coordinates, route endpoints, IP lookup requests, and Amap API key to Gaode/Amap. Prefer a restricted Amap key, avoid putting the key directly on command lines, and do not store it in ~/.bashrc on shared or monitored systems.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/poi_search.py:280
Finding

API Key Exposure Through Command-Line Arguments and Plaintext Shell Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description is incomplete relative to the documented behaviors, including IP-based geolocation, geocoding, reverse geocoding, and autocomplete. Behavior-description mismatch is dangerous because reviewers and users may authorize a map lookup skill without realizing it can process or transmit additional location-sensitive data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is incomplete relative to the documented behaviors, including IP-based geolocation, geocoding, reverse geocoding, and autocomplete. Behavior-description mismatch is dangerous because reviewers and users may authorize a map lookup skill without realizing it can process or transmit additional location-sensitive data.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: 6a67c14c2852222b0b7a34e74bd8bcbd
    PropagateID: 6a67c14c2852222b0b7a34e74bd8bcbd
    ReservedCode1: 3044022013c2f6dc72f2acadc50b2625eaafa287dde34ae48617a50386545dad5b8116170220643a821218ef525727b7f8c4022ce662a3b2ee41640740b63e83b8464e58e28c
    ReservedCode2: 304602210090433f12363718a8833b9c9d782c9328554694f84915060c71ec84c68f811294022100ba8cdda85c6eed92e12381129f3bb1acbedb8e21d22463e69407a81aa26f20f8
description: 高德地图全功能工具 - 集成POI搜索、路径规划、天气查询、公交查询、实时路况等。/Gaode Map All-in-One - POI search, route planning, weather, bus, traffic.
icon: "\U0001F5FA️"
name: amap-search
version: 2.0.0
---

# 🗺️ 高德地图全功能工�

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Key 名称 6. 服务平台：勾选 「Web服务」 7. 点击「提交」，获取 Key

💡 免费额度：每个 Key 每天 2000 次调用，个人使用足够

第二步：配置 API Key（推荐使用环境变量）

方式一：设置环境变量（推荐）

bash
# 在终端中设置环境变量
export AMAP_API_KEY="你的API_KEY"

# 或在 ~/.bashrc 中永久添加
echo 'export AMAP_API_KEY="你的API_KEY"' >> ~/.bashrc
source ~/.bashrc

方式二：命令行参数

bash
python3 gaode_map.py <命令> --key 你的API_KEY [参数]

⚠️ 优先级：环境变量 > 命令行参数。建议使用环境变量，避免每次输入。

📖 详细使用说明

1️⃣ IP定位 (ip)

获取用户当前所在城市。

bash
python3 gaode_map.py ip --key 你的KEY

输出示例：

text
Your location: 四川省 成都市
City code: 510100

2️⃣ 地理编码 (geo)

将地址转换为经纬度坐标。

ba

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documentation indicates use of environment variables and outbound network access, but the manifest does not declare any explicit tool scope or permissions. This creates an authorization and review gap: consumers cannot clearly see that the skill needs network and env access, increasing the chance of over-privileged or unexpectedly data-exfiltrating behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises automatic IP-based location lookup but does not clearly warn that location-related data derived from the user's IP will be sent to the external map provider. In a location-services context, this is privacy-relevant because users may not expect geolocation data transmission or understand its sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill sends user-supplied locations, addresses, IPs, routes, and search terms to a third-party map API, and some are transmitted in URL query strings. In a map/search skill this sharing is expected, but without an explicit user-facing privacy notice or consent cue, sensitive geolocation and query data may be exposed to the external provider, logs, proxies, or shell history.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes the skill as including '公交查询/Bus query', and the file header also lists a 'bus' command, but the actual CLI only defines commands for ip, geo, regeo, poi, route, weather, traffic, and tips. There is no bus-specific command or implementation, so the delivered behavior is narrower than the stated all-in-one description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends potentially sensitive user data, including IP addresses, precise coordinates, and street addresses, to the external Amap API via network requests without any explicit user-facing disclosure or consent flow. In a location skill, this data sharing is expected for functionality, but the lack of transparency can expose users to privacy harm, especially when coordinates or IP-based location are used implicitly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring explicitly lists '- bus : Bus/Transit search' as a supported command. However, the argument parser never creates a 'bus' subcommand, and bus-related functionality is only partially folded into route transit planning, so the documentation actively misstates what users can invoke.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file contains user-visible strings and help text in both English and Chinese, including error/help messages such as the API key instructions, without documenting a locale constraint or offering the user a language selection. This can violate the language/locale policy because the skill effectively imposes mixed-language output without opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a full-featured Gaode Maps tool including route planning, weather, bus queries, and real-time traffic. In this file, the exposed commands only support IP location, POI search, nearby search, and geocoding, with no implementation of routing, weather, bus, or traffic features.

Content

No source excerpt is available for this finding.