have-a-nice-day

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:16 PM UTC
• Version: 1.0.21

Overview

This Tencent Maps skill is mostly map-service aligned, but it needs review because some workflows can expose a user's Tencent Maps API key in returned links while sending precise location and travel data to Tencent services.

Review this skill before installing. Use only a restricted, temporary Tencent Maps key with tight quotas and referrer or IP limits, avoid sharing generated links, and do not submit sensitive home, work, or third-party location data unless you are comfortable sending it to Tencent Maps. Rotate the key if it appears in chat logs or browser history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/scene2-nearby-search.md:95
• Finding: API Credential Disclosure in Nearby-Search Links<![CDATA[ ## Vulnerability Details **File Location**: `references/scene2-nearby-search.md:95-103` **Vulnerability Type**: API credential exposure through a user-facing query string **Risk Level**: Medium ### Vulnerable Code Snippet ```text https://mapapi.qq.com/web/claw/nearby-search.html?center={latitude},{longitude}&keyword={search_category}&radius=1000&key=xxx ``` The response workflow directs the Agent to replace the example values with the applicable coordinates, search category, and configured Tencent Maps API key, and then return the resulting URL to the user. ### Technical Analysis The nearby-search workflow places the API key in the `key` query-string parameter of a user-facing URL. Query strings are commonly retained in: - Assistant conversation history - Browser history and synchronization services - HTTP access logs and reverse-proxy logs - Monitoring and analytics systems - Screenshots, copied messages, and shared links - Referrer headers, depending on browser and destination policy Although the documentation displays `xxx`, the workflow requires a configured API key and instructs the Agent to generate and return the completed link. Consequently, the intended execution can substitute the actual credential into the URL. This also conflicts with the warning in `SKILL.md` that URLs containing keys must not be shared or logged. ### Attack Path 1. The user configures a valid Tencent Maps API key through `TMAP_LBS_CONFIG`. 2. The user requests a nearby search. 3. The workflow calls the geocoding service and obtains the requested location's coordinates. 4. The Agent constructs the documented nearby-search URL and inserts the configured API key into its query string. 5. The Agent returns the completed URL in the conversation. 6. The URL and credential may be retained in chat history, browser history, logs, screenshots, or copied messages. 7. A party with access to any retained copy extracts the `key` parameter. 8. The exposed key is reused agains ...[truncated 603 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never place the Tencent Maps API key in assistant output or any user-facing URL. 2. Move authenticated API calls behind a trusted backend that attaches the credential server-side. 3. Return an opaque, short-lived session identifier rather than the API key. 4. If browser-side authorization is unavoidable, issue a narrowly scoped, short-lived token that cannot be used for unrelated API operations. 5. Configure strict API restrictions, including allowed services, referrers or source IP addresses, quotas, and expiration. 6. Apply a restrictive `Referrer-Policy`, such as `no-referrer`, to map pages. 7. Redact `key`, `token`, and similar parameters from application, proxy, analytics, and audit logs. 8. Revoke and rotate any key that may already have appeared in generated links. 9. Update the response template to return a credential-free link or structured search results instead. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/scene5-travel-planner.md:128
• Finding: API Credential Disclosure in Travel-Planning Links<![CDATA[ ## Vulnerability Details **File Location**: `references/scene5-travel-planner.md:128-145` **Vulnerability Type**: API credential exposure through a user-facing query string **Risk Level**: Medium ### Vulnerable Code Snippet ```text https://mapapi.qq.com/web/claw/travel.html?spots=[{"name":"Forbidden City","lat":39.918,"lng":116.397},{"name":"Summer Palace","lat":39.999,"lng":116.275},{"name":"Fragrant Hills","lat":39.993,"lng":116.188},{"name":"Universal Studios","lat":39.843,"lng":116.681}]&recommend=restaurant,hotel&key=xxx ``` The travel-planning response template instructs the Agent to return a completed URL containing the configured API key in the `key` parameter. ### Technical Analysis The travel-planning workflow embeds a Tencent Maps API credential directly into a clickable URL. Even when HTTPS protects the URL in transit, the complete query string can still persist at endpoints and in local or third-party storage, including conversation records, browser history, proxy logs, analytics systems, screenshots, and copied links. The example uses `xxx`, but the surrounding workflow requires the user's configured key and directs the Agent to build and return the final planning URL. Therefore, replacing the placeholder with the actual credential is the intended operational behavior. The URL also exposes the user's selected destinations and travel interests. Those values are required for the requested travel-planning functionality, but combining them with a reusable credential increases the sensitivity of retained or shared copies. ### Attack Path 1. The user configures a valid Tencent Maps API key through `TMAP_LBS_CONFIG`. 2. The user requests travel planning for one or more destinations. 3. The workflow geocodes each destination using the configured key. 4. The Agent creates the documented travel-planning URL containing destination coordinates, recommendation preferences, and the API key. 5. The completed URL is returned in the conversation ...[truncated 757 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the API key from all travel-planning URLs and response templates. 2. Implement travel-plan generation through a trusted backend that stores and applies credentials server-side. 3. Return an opaque, expiring plan identifier or a credential-free page URL to the user. 4. Avoid placing long-lived credentials in query strings under all circumstances. 5. If a client token is necessary, make it short-lived, single-purpose, and restricted to the specific plan. 6. Configure strict service, referrer or IP, quota, and expiration restrictions for all Tencent Maps credentials. 7. Apply `Referrer-Policy: no-referrer` and prevent query strings from being collected by analytics. 8. Redact sensitive parameters from application, browser-facing, reverse-proxy, and monitoring logs. 9. Revoke and rotate any API key previously inserted into generated links. 10. Clearly disclose that destination coordinates and recommendation preferences are sent to Tencent Maps as necessary for the requested service. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: 整体上，代码与声明的大方向基本一致：确实围绕腾讯地图位置服务，包含 POI 搜索、多种路径规划和旅游规划能力。代码还会访问腾讯地图 API，这与描述相符，并未发现明显的额外高风险或无关能力。However，声明中的“轨迹数据可视化”和“地图数据可视化”是较明确的能力表述，而实际代码并没有实现真正的可视化渲染、轨迹展示或地图展示，只是返回 POI/路线相关结构化数据，供外部系统可能进一步渲染。因此描述对可视化能力有明显夸大。另，“周边搜索”并非独立功能模块，但可通过 query_place 的 nearby boundary 参数部分实现。综合来看，存在描述大于实际实现的能力不匹配。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares environment and implied network use but does not define an explicit tool/permission scope. That creates an authorization ambiguity where the runtime may permit broader access than users or reviewers expect, especially since the skill references API usage, external web services, and a secret-bearing environment variable.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger rules are very broad, including common verbs like “搜”, “找”, “查”, “附近”, and “规划”, which can cause the skill to activate for ordinary conversations unrelated to explicit map-service intent. In this skill context, accidental activation matters because user queries may include sensitive locations that would then be sent to Tencent mapping services or processed under the wrong workflow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill does not clearly warn users that their supplied addresses, coordinates, route endpoints, and nearby-search terms will be transmitted to Tencent Map web services. This creates a privacy and data-governance risk, especially because location data is highly sensitive and the skill is designed around geocoding, POI lookup, and route planning.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file emits user-facing console messages and error text entirely in Chinese, and similar hard-coded Chinese output appears throughout the skill. This imposes a specific language on users without any opt-in or locale selection, matching the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The reply template is written entirely in Chinese and instructs the skill to return a fixed Chinese response. This creates a language/locale policy issue because the file does not offer user opt-in or an alternative language, and no region-specific justification is provided.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs users to place a Tencent Maps API key directly into curl URLs and generated shareable links, which can expose the key through shell history, application logs, browser history, referrer leakage, screenshots, or copied links. Because the workflow also tells the agent to return the full URL to the user, the risk of accidental credential disclosure is materially increased by the skill context.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: Line L006 instructs to '不要生成代码后者调取其他脚本后者接口', which states the workflow should not call other scripts or interfaces. However, later instructions explicitly require invoking Tencent's geocoding API with a curl request at L036-L047, directly contradicting that earlier instruction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to provide a temporary Tencent Maps API key and precise coordinates for POI and nearby searches, but it does not warn that sensitive location/query data will be transmitted to a third-party service. This can lead to uninformed disclosure of user location, search intent, and associated metadata, which is a real privacy/security concern in a location-services skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly instructs users to send precise origin and destination coordinates to a third-party mapping API, but it does not provide any privacy warning, consent guidance, retention note, or data-minimization advice. Because location data is highly sensitive and route-planning workflows can reveal home/work patterns and travel habits, omission of privacy guidance increases the risk of inadvertent exposure or non-compliant data handling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to send user-provided itinerary details and a Tencent Maps API key to external Tencent endpoints, but it does not clearly warn the user that their travel preferences and configured key will be transmitted to a third-party service. In this context, the omission is security-relevant because the workflow also instructs embedding the API key directly in generated URLs, which can expose the key via logs, browser history, referrers, or link sharing.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The package description is written entirely in Chinese and does not indicate that the skill is China-specific or that other languages are supported. Under the language/locale policy, this can be a natural-language policy issue when a specific language is imposed without opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The file presents all user-facing instructions and reply templates exclusively in Chinese and does not indicate that language selection is optional. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue unless the restriction is clearly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Natural-language policy violations apply to all file types, including markdown. The document presents all instructions, parameter explanations, and examples only in Chinese and does not indicate that the user may choose another language or that the skill is intentionally restricted to a Chinese-language or region-specific context.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All instructions, examples, and reply templates are specified exclusively in Chinese, and the skill does not indicate that users may choose another language. This can violate language/locale policy when a skill effectively forces a specific language without opt-in.

Static analysis

No suspicious patterns detected.