T09 · Insecure Skill Coding Practices
Warning
- Location
references/scene2-nearby-search.md:73- Finding
Tencent Maps API Key Exposed in User-Facing Nearby Search URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
tmap-lbs-service
Security checks for vulnerabilities and agentic risk
Overview
This Tencent Maps skill is mostly purpose-aligned, but it needs review because its documented workflows can expose a Tencent Maps API key and precise location or travel data in generated links.
Review before installing. Use only a restricted temporary Tencent Maps API key, avoid sensitive home/work routes, vehicle plate numbers, private itinerary details, or secret-bearing trajectory URLs, and do not share generated links that contain a key. Prefer an updated version that keeps API keys server-side and clearly warns before sending location data to Tencent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/scene5-travel-planner.md:78- Finding
Tencent Maps API Key Exposed in User-Facing Travel Planning URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The core declared capabilities around Tencent Maps, POI search, and route planning are broadly represented in the code. The trip planning helper is also consistent with the declared tourism-planning purpose. However, the description explicitly claims support for trajectory data visualization and map data visualization, while the code only returns structured POI/route/task data and contains no visualization/rendering logic. Additionally, 'nearby search' is not exposed as a distinct capability; it is only a parameterized mode within the general POI search function. Therefore the description overstates implemented functionality, making it a mismatch.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger set includes very broad everyday terms such as '搜', '找', '查', '附近', and '规划', which can cause the skill to activate on unrelated user requests. In a skill that may transmit location or query data to external Tencent services, overbroad activation increases the risk of unintended data disclosure and inappropriate tool use.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill requires environment configuration and performs external network interactions, but it does not declare any explicit tool scope such as allowed tools or permissions. That weakens runtime governance and reviewability, making it easier for the skill to access secrets or invoke networked behavior without clear operator approval boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill processes sensitive location and possibly trajectory data through external Tencent Map services but does not clearly warn users that their provided addresses, coordinates, or route data may be transmitted off-platform. This undermines informed consent and can expose sensitive movement patterns or personal location information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Natural-language text in comments, logs, and thrown errors is consistently Chinese, including the primary setup guidance presented to users when configuration is missing. There is no indication that the skill is intentionally limited to Chinese-speaking users or that an alternative language is available.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends user-supplied search terms, origin/destination coordinates, and potentially sensitive fields like plate_number to Tencent's external map API via HTTP requests, but the code provides no explicit user notice, consent flow, or minimization controls around that data transfer. In a location-services skill this transmission is functionally necessary, but it still creates a real privacy/security issue because precise location and vehicle identifiers can reveal sensitive movement patterns if users are not clearly informed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example triggers use broad, common phrases like searching for food or hotels without defining clear scope boundaries, which can cause the skill to activate in unintended contexts. In an agent setting, overbroad activation increases the chance of misrouting user requests, leaking context into external link generation, or performing actions the user did not specifically intend.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill is written as Chinese-only operational guidance and includes fixed Chinese reply templates, with no indication that the user may choose another language. This creates a locale/language policy issue because it implicitly constrains responses to a specific language without documented opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to provide a temporary Tencent API key and perform POI and nearby searches using keywords and precise coordinates, but it does not clearly warn that those queries and location data will be transmitted to Tencent's external service. This creates a real privacy and transparency issue because users may disclose sensitive location or search intent without informed consent, especially for nearby-search use cases tied to exact coordinates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation instructs users to send precise origin and destination coordinates to Tencent Map Web Service but does not clearly warn that this shares potentially sensitive location data with a third-party provider. Exact route endpoints can reveal home, workplace, habits, or other private movements, so the omission creates a real privacy/security risk even though it is not obviously malicious.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs sending the user's itinerary data (planned destinations) and a user-provided Tencent Maps API key to external Tencent endpoints, but it does not clearly warn users that this data will leave the local system or describe the privacy implications. Even though the destinations are needed for functionality, the absence of an explicit data-sharing notice can lead to uninformed disclosure of potentially sensitive travel plans and credential misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation section says the skill should trigger when a user mentions terms like “轨迹”, “轨迹图”, “轨迹可视化”, or similar intents, plus data. This is broad and open-ended because “等意图” leaves the trigger scope undefined and provides no negative examples or exclusion conditions, which can cause unintended invocation for general discussions of trajectories or movement data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to embed a user-supplied trajectory data URL into a third-party Tencent Map link without warning the user that their data source will be disclosed to an external service. Trajectory data can be highly sensitive, and exposing the source URL may leak location history, tokens in query strings, or internal endpoints to the map provider and anyone the link is shared with.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language description is written entirely in Chinese and does not indicate any user choice of language or a justified region-specific constraint. The policy requires avoiding forced language or locale unless the skill offers opt-in or clearly documents the limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All user-facing instructions, examples, and reply templates are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking locale. This can violate a language/locale policy if the organization requires user choice or explicit documentation of locale restrictions.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L041-L047 specify the geocoder request as using
location={位置}, while the complete example at L091 usesaddress=西直门. These are contradictory instructions for the same API call and can lead an agent to perform a different request than the documentation claims.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L073 and L093-L100 consistently use the URL
https://mapapi.qq.com/web/claw/nearby-search.html, but L076-L077 document the domain asmap.qq.comand the route as/m/place/search. This is an active contradiction in the file's own instructions, not merely an omitted detail, and could cause an agent to generate or use the wrong link.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. The entire skill document is presented only in Chinese and provides no indication that users may choose another language or that the locale restriction is intentional and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All instructions, examples, and reply templates are Chinese-specific, and the skill assumes Chinese-language interaction patterns without stating that it is intended only for Chinese-speaking users or offering an opt-in language choice. This can violate language/locale policy when a skill implicitly forces one language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
All instructions, trigger phrases, and response templates are written only in Chinese, and the skill does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is documented and justified.
- Content
Static analysis
No suspicious patterns detected.