Security audit

车辆年检沿途路线规划器

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform route planning as described, but it sends sensitive home/work location data and an API key to AMap while the README inaccurately says no user data is uploaded.

Review this before installing if you would use real home or workplace addresses. The skill sends location details and your AMap API key to AMap to calculate routes, so ignore the README's no-upload claim; use a restricted/rotatable API key and avoid command-line key entry when possible.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: planner.py:108
Finding: Amap API Key Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

other

Note

Location: README.md:52
Finding: Privacy Documentation Incorrectly Claims That User Data Is Not Uploaded
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README states that the tool 'does not collect or upload any user data,' but the described functionality necessarily sends home address, company address, station addresses, and the API key to AMap's web service to compute routes. This is a misleading privacy claim that could cause users to disclose sensitive location data without informed consent, especially given the skill's use of real-time traffic and external geocoding/routing APIs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly instructs use of external AMap web APIs but does not declare any tool scope, permissions, or allowed-tools boundary. This creates an authorization and review gap: a runner may permit broader network access than intended, making it easier for the skill to contact unexpected endpoints or leak sensitive user-provided data such as addresses and API keys.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file’s user-facing description, instructions, inputs, and outputs are all presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not documented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions throughout the file are exclusively Chinese, and there is no indication that users may choose another language or that the locale constraint is explicitly required. The policy asks to flag language or locale constraints when a specific language is effectively forced without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s docstring and usage guidance are entirely in Chinese, and the script later prints all user-facing status and report content in Chinese. This imposes a specific language/locale choice without any opt-in or documented justification, which matches the language-policy concern for natural-language policy violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file consists entirely of Chinese-language organization names and addresses, with no accompanying natural-language notice that the locale is intentionally Shanghai/Chinese-specific or that users may choose another language/locale. Under the policy, a file that implicitly fixes output/content to a specific language or locale without opt-in can be considered a natural-language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.