T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/search_maps.py:249- Finding
Undeclared Baidu Provider Automatically Uses an Ambient Credential
- Content
View full analysis
Vulnerability Details
File Location:
scripts/search_maps.py:249-275andscripts/search_maps.py:468-475
Vulnerability Type: Undeclared external provider and ambient credential use
Risk Level: MediumThe documented provider boundary in
SKILL.md:20-31,SKILL.md:101-105, andREADME.md:34-49lists only Amap and Serper. The implementation nevertheless activates Baidu Maps whenever the Agent process happens to contain aBMAP_KEY.python BMAP_KEY = os.environ.get('BMAP_KEY', '') def search_bmap(query: str, city: str = '', district: str = '', max_results: int = 20) -> list: """百度地图地点检索""" if not BMAP_KEY: print("⚠️ 未配置 BMAP_KEY，跳过百度搜索", file=sys.stderr) return [] region = district or city params = { 'ak': BMAP_KEY, 'query': query, 'region': region, 'output': 'json', 'page_size': min(max_results, 20), 'page_num': 0, 'scope': 2, 'filter': 'industry_type:cater', } url = f"https://api.map.baidu.com/place/v2/search?{urlencode(params)}"The provider is then invoked automatically during a normal mainland-China search:
python bmap = [] if BMAP_KEY: print(f"🗺️ 百度地图搜索（可选）...", file=sys.stderr) bmap = search_bmap(query, city or district, district, max_results) print(f" 百度: {len(bmap)} 家", file=sys.stderr) merged = merge_cn_sources(amap, bmap)Technical Analysis
The module reads
BMAP_KEYfrom the ambient process environment at import time. A normal China search checks only whether that variable is present and then sends the key, restaurant query, and city or district tohttps://api.map.baidu.com.There is no explicit provider selection or per-request consent. Baidu Maps is also absent from the Skill's declared external-call metadata and conflicts with the documented statement that restaurant queries and destination ...[truncated 1425 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the Baidu integration if Amap is intended to be the sole mainland-China provider.
- If Baidu support is retained, declare
https://api.map.baidu.com,BMAP_KEY, the transmitted fields, and the provider purpose inSKILL.md,README.md, and Skill metadata. - Require explicit opt-in or an explicit provider-selection argument before accessing
BMAP_KEYor contacting Baidu. - Read the credential only inside the explicitly selected provider path rather than at module import time.
- Ensure the router invokes exactly one selected primary provider unless the user has separately enabled a documented cross-verification provider.
- Add tests confirming that an ambient
BMAP_KEYalone cannot trigger an outbound request. - Update privacy documentation to identify every possible data recipient and explain when cross-provider disclosure occurs.