Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it opens a local map app for a user-provided destination, with no hidden scripts or persistence found.
Install only if you want an agent to open your local map application on explicit request. Destination text or coordinates may be handed to Apple Maps or another registered URL handler, so avoid sending sensitive locations unless that is intended; the publisher should ideally clarify trigger rules and encode destination parameters safely.
Natural-language content in the description, usage, and notes is exclusively Chinese, which can impose a language constraint on users without opt-in. The policy allows locale restrictions when they are explicitly documented and justified, but no such justification or alternative language option is provided here.
The skill launches a local GUI application and passes user-provided destination data to the system URL handler via the open command, but it does not explicitly warn users that external local application execution will occur. While the action is expected for a map skill, lack of disclosure can lead to unexpected app launches or unintended sharing of destination data with the OS map handler or another registered handler.
This markdown file describes invocation using natural-language phrases like '打开地图 前往 北京 天安门' and '打开地图 坐标 ...', but it does not specify whether only these exact forms trigger the skill or what similar phrases should not trigger it. Without explicit scope or negative examples, the activation conditions may be interpreted too broadly and cause unintended invocation.
No suspicious patterns detected.
