Map Address Query

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:40 AM UTC
• Version: 0.1.0

Overview

The skill has a legitimate map-query purpose, but it asks users to run an unverified downloaded executable and persist an API key globally, which warrants Review before installation.

Install only if you are comfortable running a third-party binary downloaded from GitHub under your user account. Before use, verify the downloaded CLI independently, prefer a restricted or throwaway Tencent key, avoid submitting sensitive personal locations, and check or lock down permissions on ~/.qq_map_cli_config.json if you store a key there.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/qq_map_cli.sh:12
• Finding: Unverified Remote Binary Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/qq_map_cli.sh:12-20, 31-37` **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash if [ "$OS" = "Darwin" ]; then DOWNLOAD_URL="https://github.com/scottkiss/qq-map-cli/releases/download/v1.0.2/qq-map-cli-darwin-arm64.zip" CMD_NAME="qq-map-cli" elif [ "$OS" = "Linux" ]; then DOWNLOAD_URL="https://github.com/scottkiss/qq-map-cli/releases/download/v1.0.2/qq-map-cli-linux-x86_64.zip" CMD_NAME="qq-map-cli" elif echo "$OS" | grep -iq 'mingw\|cygwin\|msys\|windows_nt'; then DOWNLOAD_URL="https://github.com/scottkiss/qq-map-cli/releases/download/v1.0.2/qq-map-cli-windows-x86_64.zip" CMD_NAME="qq-map-cli.exe" ``` ```bash if [ ! -x "$CMD_PATH" ] && [ ! -f "$CMD_PATH" ]; then echo "Downloading $CMD_NAME..." >&2 mkdir -p "$BIN_DIR" curl -L -s "$DOWNLOAD_URL" -o "$BIN_DIR/$ZIP_FILE" unzip -q -o "$BIN_DIR/$ZIP_FILE" -d "$BIN_DIR" if [ "$CMD_NAME" = "qq-map-cli" ]; then chmod +x "$CMD_PATH" fi rm -f "$BIN_DIR/$ZIP_FILE" echo "Download complete: $CMD_PATH" >&2 else echo "$CMD_NAME is already downloaded at $CMD_PATH" >&2 fi ``` ### Technical Analysis The installation script downloads a precompiled executable from a release belonging to a personal GitHub repository. It extracts the archive and marks the resulting file as executable without verifying a cryptographic checksum, digital signature, trusted publisher identity, or reproducible build provenance. Pinning the URL to release tag `v1.0.2` limits accidental version changes but does not establish artifact integrity. A compromised repository account, release asset, hosting platform, or redirected download destination could supply a different executable while retaining the expected filename and URL. The use of `curl -L` follows redirects, and the script performs no validation of the final destination or downl ...[truncated 1854 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish and audit the CLI source, then build it locally or through a verifiable, trusted build process. 2. Record a separate SHA-256 or stronger digest for every supported platform artifact in the Skill package. 3. Verify the digest before extraction and execution, and terminate immediately on any mismatch. 4. Cryptographically sign release artifacts and verify signatures against a pinned, documented maintainer key. 5. Use `curl --fail --show-error --location` and validate the final download origin rather than suppressing errors with `-s`. 6. Download into a securely created temporary directory, validate the archive contents, and only then atomically install the expected executable. 7. Avoid overwriting arbitrary extracted files and reject archives containing unexpected names, links, or paths. 8. Prefer an official Tencent API client or a source-based dependency from a well-governed package registry. 9. Clearly disclose that the executable is third-party code and obtain user approval before downloading and running it. 10. Run the client with restricted filesystem and network permissions where sandboxing is available. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28
• Finding: Tencent API Key Exposed Through Command-Line Arguments and Unspecified File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-30, 90-95` **Vulnerability Type**: Insecure secret handling and persistent plaintext configuration **Risk Level**: Medium ### Vulnerable Code ```bash ./scripts/bin/qq-map-cli setup --config ~/.qq_map_cli_config.json --key "your-key" # Windows: .\scripts\bin\qq-map-cli.exe setup --config %USERPROFILE%\.qq_map_cli_config.json --key "your-key" ``` ```markdown 4. If the key is still missing after setup, stop and ask the user for the Tencent Location Service key instead of trying live queries. 5. After the user provides the key, immediately persist it globally by running `setup --config ~/.qq_map_cli_config.json --key "..." --force`. 6. Treat `~/.qq_map_cli_config.json` as a globally persistent config so the user does not need to configure it again for queries in other directories. ``` Equivalent secret-bearing command examples also appear in `README.md:30-32` and `README.md:78-80`. ### Technical Analysis The documented setup workflow places the Tencent API key directly in the process command line through the `--key` argument. Depending on the operating system and execution environment, command-line arguments may be observable through process inspection, shell history, terminal transcripts, Agent tool-call records, telemetry, or centralized execution logs. The instructions also require the Agent to persist the key in `~/.qq_map_cli_config.json`, but neither the Skill nor its wrapper creates the file itself with restrictive permissions. Because the downloaded CLI implementation is unavailable for review, the audit cannot verify that it creates the file with owner-only permissions such as `0600`, avoids logging the key, or stores it securely. Persistent configuration is useful for the declared workflow, but mandatory immediate global persistence is not the least-exposure approach. A session-scoped environment variable, protected standard input, operating-system credential store, or user-confirme ...[truncated 1319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place API keys in command-line arguments. 2. Support secret input through a non-echoing interactive prompt or protected standard input. 3. Prefer an operating-system credential store or Agent-provided secret-management facility. 4. If environment-variable support is retained, inject the variable only into the child process and ensure it is excluded from logs and diagnostic output. 5. Make persistent storage optional and obtain explicit user approval before writing credentials outside the project directory. 6. Create the configuration file atomically with owner-only permissions, such as mode `0600` on Unix-like systems, and verify the parent directory is not writable by untrusted users. 7. Apply equivalent restrictive access controls on Windows. 8. Ensure the CLI redacts keys from errors, JSON output, debug logs, telemetry, and crash reports. 9. Document how users can revoke and rotate a potentially exposed key. 10. Encourage Tencent-side restrictions such as API allowlists, usage limits, and separate low-privilege keys for this Skill. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script retrieves a zip archive from GitHub and installs an executable into a local bin directory without any integrity verification such as a checksum or signature check. If the release asset, account, network path, or dependency chain is compromised, a malicious binary could be installed and later executed with the user's privileges.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ "$CMD_NAME" = "qq-map-cli" ]; then
        chmod +x "$CMD_PATH"
    fi
    rm -f "$BIN_DIR/$ZIP_FILE"
    echo "Download complete: $CMD_PATH" >&2
else
    echo "$CMD_NAME is already downloaded at $CMD_PATH" >&2

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README encourages users to submit addresses and route queries to Tencent's map service but does not disclose that user-provided location data will be transmitted to a third-party provider. In a skill specifically designed to process addresses and coordinates, this omission creates a meaningful privacy and data-handling risk because users or agents may unknowingly send sensitive location information off-platform.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. **Get an API Key:**
   - Visit [Tencent Location Service Console](https://lbs.qq.com/dev/console/application/mine).
   - Click "创建应用" (Create Application) and "添加key" (Add Key).
   - Copy the generated Key.

3. **Configure the Key globally:**

• Confidence: 87% confidence
• Finding: The README instructs users to configure the API key globally in a persistent file under the user's home directory, increasing the chance that long-lived credentials are stored on disk and reused across sessions. If the config file is readable by other local users, included in backups, or accidentally exposed, the key could be abused to make unauthorized API calls and incur cost or quota exhaustion.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell commands and downloads/executes a CLI, but it declares no explicit tool scope or allowed-tools boundary. That increases the chance an agent can run shell actions unexpectedly, making command execution and external network access available without clear restriction or review.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger says the skill MUST be used for broad categories like coordinates, POIs, and distance queries, which can cause over-invocation on many common location-related prompts. In practice, this may route ordinary requests into a shell-capable workflow unnecessarily, increasing exposure to external command execution and credential-handling steps.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Quick Start

- If the global config file does not exist, create one first:

```bash
# On Mac/Linux

• Confidence: 88% confidence
• Finding: The skill directs creation of a persistent global config file in the user's home directory, creating session persistence beyond the current task. In the context of a shell-enabled skill that may later contain credentials, this persistence increases the blast radius of mistakes, unauthorized reuse, and cross-workspace data leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow instructs the agent to persist the user's Tencent API key globally in a home-directory config file and to do so immediately, but it does not require a clear user warning or consent about long-term credential storage. Persisted secrets can be exposed to other processes, future sessions, or unintended users on the same system.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script bootstraps functionality by downloading and installing a remote executable at runtime, which expands the skill's effective capabilities beyond simple map lookup logic contained in the repository. This creates a supply-chain and trust-boundary risk because the actual code executed is fetched externally and can change independently of the reviewed skill contents.

External Transmission

Medium

• Category: Data Exfiltration

Content

if [ ! -x "$CMD_PATH" ] && [ ! -f "$CMD_PATH" ]; then
    echo "Downloading $CMD_NAME..." >&2
    mkdir -p "$BIN_DIR"
    curl -L -s "$DOWNLOAD_URL" -o "$BIN_DIR/$ZIP_FILE"
    unzip -q -o "$BIN_DIR/$ZIP_FILE" -d "$BIN_DIR"
    if [ "$CMD_NAME" = "qq-map-cli" ]; then
        chmod +x "$CMD_PATH"

• Confidence: 87% confidence
• Finding: The curl invocation transmits information to an external service and downloads executable content from a third-party host. In this skill context, outbound network access to map services is expected, but fetching an executable from GitHub is a different and more dangerous kind of external transmission because it introduces code into the environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs a silent network download and writes executable content into the local filesystem with minimal user-facing disclosure. Even if intended for convenience, this reduces informed consent and makes it easier for users to unknowingly accept network transfer and local installation of code.

Static analysis

No suspicious patterns detected.