Map Address Query

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:40 AM UTC
• Version: 0.1.0

Overview

The skill has a legitimate map-query purpose, but it asks users to run an unverified downloaded executable and persist an API key globally, which warrants Review before installation.

Install only if you are comfortable running a third-party binary downloaded from GitHub under your user account. Before use, verify the downloaded CLI independently, prefer a restricted or throwaway Tencent key, avoid submitting sensitive personal locations, and check or lock down permissions on ~/.qq_map_cli_config.json if you store a key there.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/qq_map_cli.sh:12

Finding

Unverified Remote Binary Download and Execution

Content

View full analysis

&2 mkdir -p "$BIN_DIR" curl -L -s "$DOWNLOAD_URL" -o "$BIN_DIR/$ZIP_FILE" unzip -q -o "$BIN_DIR/$ZIP_FILE" -d "$BIN_DIR" if [ "$CMD_NAME" = "qq-map-cli" ]; then chmod +x "$CMD_PATH" fi rm -f "$BIN_DIR/$ZIP_FILE" echo "Download complete: $CMD_PATH" >&2 else echo "$CMD_NAME is already downloaded at $CMD_PATH" >&2 fi ``` ### Technical Analysis The installation script downloads a precompiled executable from a release belonging to a personal GitHub repository. It extracts the archive and marks the resulting file as executable without verifying a cryptographic checksum, digital signature, trusted publisher identity, or reproducible build provenance. Pinning the URL to release tag `v1.0.2` limits accidental version changes but does not establish artifact integrity. A compromised repository account, release asset, hosting platform, or redirected download destination could supply a different executable while retaining the expected filename and URL. The use of `curl -L` follows redirects, and the script performs no validation of the final destination or downl ...[truncated 1854 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Tencent API Key Exposed Through Command-Line Arguments and Unspecified File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script retrieves a zip archive from GitHub and installs an executable into a local bin directory without any integrity verification such as a checksum or signature check. If the release asset, account, network path, or dependency chain is compromised, a malicious binary could be installed and later executed with the user's privileges.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/qq_map_cli.sh (reported line 38)May include surrounding context.

sh

if [ "$CMD_NAME" = "qq-map-cli" ]; then
        chmod +x "$CMD_PATH"
    fi
    rm -f "$BIN_DIR/$ZIP_FILE"
    echo "Download complete: $CMD_PATH" >&2
else
    echo "$CMD_NAME is already downloaded at $CMD_PATH" >&2

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages users to submit addresses and route queries to Tencent's map service but does not disclose that user-provided location data will be transmitted to a third-party provider. In a skill specifically designed to process addresses and coordinates, this omission creates a meaningful privacy and data-handling risk because users or agents may unknowingly send sensitive location information off-platform.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The README instructs users to configure the API key globally in a persistent file under the user's home directory, increasing the chance that long-lived credentials are stored on disk and reused across sessions. If the config file is readable by other local users, included in backups, or accidentally exposed, the key could be abused to make unauthorized API calls and incur cost or quota exhaustion.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md

2. **Get an API Key:**
   - Visit [Tencent Location Service Console](https://lbs.qq.com/dev/console/application/mine).
   - Click "创建应用" (Create Application) and "添加key" (Add Key).
   - Copy the generated Key.

3. **Configure the Key globally:**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands and downloads/executes a CLI, but it declares no explicit tool scope or allowed-tools boundary. That increases the chance an agent can run shell actions unexpectedly, making command execution and external network access available without clear restriction or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger says the skill MUST be used for broad categories like coordinates, POIs, and distance queries, which can cause over-invocation on many common location-related prompts. In practice, this may route ordinary requests into a shell-capable workflow unnecessarily, increasing exposure to external command execution and credential-handling steps.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill directs creation of a persistent global config file in the user's home directory, creating session persistence beyond the current task. In the context of a shell-enabled skill that may later contain credentials, this persistence increases the blast radius of mistakes, unauthorized reuse, and cross-workspace data leakage.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

Quick Start

• If the global config file does not exist, create one first:

bash

# On Mac/Linux

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the agent to persist the user's Tencent API key globally in a home-directory config file and to do so immediately, but it does not require a clear user warning or consent about long-term credential storage. Persisted secrets can be exposed to other processes, future sessions, or unintended users on the same system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script bootstraps functionality by downloading and installing a remote executable at runtime, which expands the skill's effective capabilities beyond simple map lookup logic contained in the repository. This creates a supply-chain and trust-boundary risk because the actual code executed is fetched externally and can change independently of the reviewed skill contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The curl invocation transmits information to an external service and downloads executable content from a third-party host. In this skill context, outbound network access to map services is expected, but fetching an executable from GitHub is a different and more dangerous kind of external transmission because it introduces code into the environment.

Content

Scanner excerpt · scripts/qq_map_cli.sh (reported line 33)May include surrounding context.

sh

if [ ! -x "$CMD_PATH" ] && [ ! -f "$CMD_PATH" ]; then
    echo "Downloading $CMD_NAME..." >&2
    mkdir -p "$BIN_DIR"
    curl -L -s "$DOWNLOAD_URL" -o "$BIN_DIR/$ZIP_FILE"
    unzip -q -o "$BIN_DIR/$ZIP_FILE" -d "$BIN_DIR"
    if [ "$CMD_NAME" = "qq-map-cli" ]; then
        chmod +x "$CMD_PATH"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs a silent network download and writes executable content into the local filesystem with minimal user-facing disclosure. Even if intended for convenience, this reduces informed consent and makes it easier for users to unknowingly accept network transfer and local installation of code.

Content

No source excerpt is available for this finding.