Travelmapify

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 2.2.2

Overview

This travel-map skill has a coherent purpose, but it should be reviewed because its local helper services can execute unsafe commands and expose more workspace data than needed.

Do not install this version without review or fixes. Require the publisher to replace shell exec with argument-array execution, bind local services to loopback with restricted CORS/auth where needed, serve only a dedicated output directory, stop killing unknown port owners, remove or rotate the shared Amap key, pin dependencies, and sanitize generated HTML and localStorage-rendered data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/amap-proxy.js:9

Finding

Unauthenticated Shell Command Injection in the Amap Proxy

Content

View full analysis

{ if (error) { console.error('Search error:', error); response.writeHead(500, corsHeaders); response.end(JSON.stringify({ error: 'Search failed', details: error.message })); return; } // ... }); } function handleDetail(poiId, response) { const amapMapsDir = path.join(__dirname, '..', '..', 'amap-maps'); const amapKey = process.env.AMAP_KEY || "88628414733cf2ccb7ce2f94cfd680ef"; const command = `cd "${amapMapsDir}" && AMAP_KEY="${amapKey}" node scripts/amap.js search detail "${poiId}"`; exec(command, { timeout: 10000 }, (error, stdout, stderr) => { // ... }); } ``` The affected values originate from HTTP requests: ```javascript if (pathname === '/api/search' && req.method === 'GET') { const query = parsedUrl.query.q; const city = parsedUrl.query.city || '重庆'; // ... handleSearch(query, city, res); } if (pathname.startsWith('/api/detail ...[truncated 1974 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/main_travel_mapify_enhanced.py:87

Finding

OpenClaw Workspace Exposed Through a Broad HTTP Document Root

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_from_optimized_template.py:37

Finding

Stored and DOM-Based Script Injection in Generated Travel Maps

Content

View full analysis

${number}. ${poi.name}

${poi.address || ''}

`; ``` ```javascript html += `

${index + 1}

${poi.name}

×

`; poiListDiv.innerHTML = html; ``` Search ...[truncated 2827 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/ensure_servers_running.py:24

Finding

Automatic Termination of Unrelated Processes Occupying Fixed Ports

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:72

Finding

Unpinned Global Installation of an Executed Third-Party Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/amap-proxy.js:21

Finding

Hardcoded and Publicly Distributed Amap API Credential

Content

View full analysis

``` ### Technical Analysis The API key is committed to source code and included in generated client-side HTML. Any person who can obtain the project or generated page can copy and reuse it. An environment-variable override does not protect the embedded fallback. Browser-side API keys may sometimes be intentionally public, but they still require strict provider-side origin, service, quota, and usage restrictions. The project provides no evidence in the reviewed code that such restrictions are enforced. The same key is used in both browser and proxy contexts, broadening its exposure and making rotation more difficult. ### Attack Path 1. An attacker downloads the repository, receives a generated map, or inspects the page source. 2. The attacker extracts the Amap key from the script URL or proxy source. 3. The attacker uses the key in unauthorized API requests. 4. Requests consume the project’s quota or trigger provider abuse controls. 5. The legitimate application experiences throttling, billing impact, or key revocation. ### Impact Assessment Potential consequences include: - Unauthorized use of the project’s Amap quota. - Service degradation or denial of service through quota exhaustion. - Unexpected charges where usage is billable. - Key suspension or revocation by the provider. - Difficulty attribu ...[truncated 205 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (63)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Claiming implemented map creation, hotel search, and AI Vision while returning placeholders is deceptive from a security perspective because it undermines trust in the skill manifest. In a plugin ecosystem, inaccurate manifests can be abused to smuggle in unrelated privileged behavior behind an appealing description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code builds a shell command with untrusted user-controlled values (query and city) and executes it via child_process.exec. Because these values are interpolated directly into a shell string without escaping, an attacker can inject shell metacharacters and execute arbitrary commands on the host running the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file describes city detection using Chinese place names and states a default fallback to Shanghai, but nowhere indicates that the skill is China-specific or that users can choose another language/locale. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Stating that a built-in default Amap API key is included and that no user key is required suggests the skill may embed shared credentials. Embedded default API keys can be extracted, abused by unauthorized parties, tied to the developer's account, and may expose users to undisclosed data-sharing and privacy risks when location queries are sent through that credential.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The requirements document discloses a built-in Amap API key and explicitly encourages using it by stating that no user key is required. Hardcoded shared API keys are sensitive operational secrets: they can be copied by anyone with access to the repository, abused outside the intended skill, and lead to quota exhaustion, billing exposure, or service suspension for all users of the skill. In this skill context, the issue is more dangerous because the key is presented as the default operational path, which promotes widespread reuse of the same credential.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and appears to require broad capabilities including shell execution, file I/O, environment access, and network access, yet it declares no explicit tool/permission scope. That makes review, sandboxing, and least-privilege enforcement much harder, and increases the chance an agent grants more access than users expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 73% confidence

Finding

The skill emphasizes unique-ID and persistent per-map localStorage state, which creates session persistence of user itinerary, hotel search preferences, and related travel data in the browser. In a travel context this can expose sensitive movement/planning information to other users of the same browser profile or to other scripts if the application is not carefully isolated.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: flyai-travelmapify
version: 2.2.2
description: Create interactive travel route maps from location names with real FlyAI hotel search. Supports AI Vision analysis of travel planning images.
author: rudy2steiner
license: MIT
tags: [travel, maps, routing, geocoding, flyai, hotels, unique-id, server-management, interactive, ai-vision]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatically starting local HTTP services without a prominent user warning is risky because it silently changes the system's network exposure and process state. Even when bound locally, this can create conflict with existing services, expose sensitive data, or be reachable by other local users/processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation is internally inconsistent about whether image analysis is performed by the skill or externally by the agent's AI Vision. That ambiguity matters because it obscures which component accesses user images and where responsibility, permissions, and data handling actually lie.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The visible UI text is entirely in Chinese, and the map is explicitly configured with lang: 'zh_cn', which enforces a specific locale. There is no user opt-in, language selector, or documentation indicating that this is an intentionally region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

User-entered search queries are sent to a localhost HTTP service without informing the user. Even though the destination is local, localhost services can bridge to privileged local components, and the plaintext HTTP channel plus lack of disclosure makes the data flow unexpected and privacy-relevant.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template persists POI itinerary data and travel dates in localStorage, which creates durable client-side storage of potentially sensitive travel history. In a skill context, this exceeds transient rendering needs and can expose private trip details to other scripts running in the same origin or to later users of the same browser profile/shared device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code stores itinerary and travel dates without any visible notice, consent, or retention explanation. Travel plans can reveal future absence, location patterns, and personal habits, so silent persistence creates a privacy risk even if no immediate exfiltration is shown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hotel search request transmits destination, POI, and travel dates to a backend service without any user-facing privacy notice. These fields are sensitive because they can reveal intended travel, timing, and interests, and in this skill they are sent automatically as part of a convenience action.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · flyai-travelmapify.py (reported line 44)May include surrounding context.

python

try:
        # Execute the main script
        result = subprocess.run(cmd)
        sys.exit(result.returncode)
    except KeyboardInterrupt:
        print("\nOperation cancelled by user", file=sys.stderr)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example sets lang: 'zh_cn', which forces a specific language/locale in the map UI. Under the stated policy, locale-specific behavior should either be user-selectable or clearly documented as a justified regional constraint.

Content

No source excerpt is available for this finding.