ClawHub
Back to skill

Security audit

Map Search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed map-search skill that sends searches to Chinese map providers, with privacy and supply-chain caveats users should understand before use.

Use this skill only if you are comfortable sending map queries, regions, and nearby-search coordinates to Amap, Baidu, and Tencent using your API keys. Prefer a virtual environment and pinned dependencies, and avoid creating the /usr/local/bin symlink unless you want a system-wide command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:245
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 245
Vulnerability Type: Unpinned and integrity-unverified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install requests

Technical Analysis

The installation command retrieves the latest available version of the requests package and its transitive dependencies without version constraints, a lock file, or cryptographic hashes. Consequently, the dependency set installed by users can change after the skill has been reviewed.

Although requests is a legitimate package and the project does not intentionally reference a suspicious package source, this installation procedure is not reproducible and does not verify artifact integrity. A compromised upstream release, dependency, package index, or package resolution path could introduce unauthorized code.

Python packages and their dependencies may execute code during installation or when imported by map_search.py. Therefore, dependency installation is part of the skill's effective execution and supply-chain attack surface.

Attack Path

  1. A user follows the installation instruction in SKILL.md.
  2. pip resolves the current requests release and its transitive dependencies from the configured package index.
  3. Because no versions or hashes are specified, the resolved artifacts may differ from those reviewed by the project maintainer.
  4. If an upstream artifact, transitive dependency, or configured package index has been compromised, malicious package code is installed.
  5. The malicious code may execute during package installation or when map_search.py imports requests.

This path requires compromise or manipulation of the dependency supply chain; the audited project itself does not contain evidence that such a compromise has already occurred.

Impact Assessment

Malicious dependency code would generally execute with the privileges of the user installing or running the skill. Depend ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

  1. Declare all direct and transitive dependencies in a reviewed requirements or lock file.
  2. Pin dependencies to exact versions rather than resolving the latest available releases.
  3. Record and enforce cryptographic hashes for every permitted artifact.
  4. Install dependencies with hash verification, for example:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Generate the lock file from a trusted environment and review dependency updates before merging them.
  2. Explicitly use the official Python Package Index or an internally controlled package mirror.
  3. Run the skill and dependency installation inside an isolated virtual environment under a non-privileged account.
  4. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose is a map search tool, but the skill behavior and documentation introduce additional capabilities such as reading local configuration, reading API keys from environment variables, and advertising IP-based location lookup and nearby search. Capability mismatch is dangerous because users and reviewers may approve the skill for one purpose while it handles location and secrets beyond what was clearly declared.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill performs network access, reads local files, and consumes environment variables, but it does not declare any tool scope or permissions boundaries. This weakens reviewability and user consent, making it easier for the skill to access sensitive data or external services without explicit disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says the tool is '更适合中国体质宝宝的地图搜索工具', which frames the skill as tailored to a specific Chinese locale/audience rather than neutrally offering locale preference. This can be a language/locale policy issue because no opt-in or alternative locale behavior is presented.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill transmits user-supplied search queries and API credentials to external map providers over the network. In context this is expected for a map search tool, but it still creates real privacy and secret-handling risk because user queries may contain sensitive places or intentions and API keys are embedded in request URLs.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
# 百度搜索
    if "baidu" in priority and BAIDU_KEY:
        url = f"https://api.map.baidu.com/place/v2/search?query={keyword}&region={region}&ak={BAIDU_KEY}&output=json"
        r = requests.get(url, timeout=5).json()
        if r.get("status") == 0:
            results["百度"] = [{"name": p["name"], "address": p.get("address", ""), "location": p.get("location", "")}

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation states '按数组顺序搜索，找到一个有效结果就停止', which describes a short-circuit search behavior. In the implementation, search_maps checks each provider independently and appends results from every enabled map service without any early return or break, so the documented control flow contradicts actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation advertises nearby-search and IP-based location features that are not implemented in the shown code. Security-relevant documentation drift is risky because reviewers may miss future additions of location tracking logic, and users may be led to expect behavior involving collection and transmission of location data without clear implementation details or controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The nearby-search description mentions automatic current-location retrieval via IP but does not provide a clear privacy warning or explicit consent model. Location inference and transmission are sensitive operations, and omission of a warning can cause users to unknowingly disclose approximate location to third parties.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill silently derives the user's approximate location from their IP address when coordinates are omitted, which expands functionality beyond simple map search into location discovery. This creates a privacy risk because a user invoking nearby search may not realize their location is being inferred and then used for subsequent searches.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · map_search.py (reported line 101)May include surrounding context.

python
# 百度
    if "baidu" in priority and BAIDU_KEY:
        url = f"https://api.map.baidu.com/place/v2/search?query={keyword}&region={region}&ak={BAIDU_KEY}&output=json"
        try:
            r = requests.get(url, timeout=5).json()
            if r.get("status") == 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When nearby search runs without explicit coordinates, the skill first infers location and then automatically transmits that location and the user's search term to external map providers. This is dangerous because it shares sensitive location context with third parties without a clear warning, opt-in, or opportunity for the user to decline.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This outbound request sends precise nearby-search location data to a third-party provider, which becomes privacy-sensitive when coordinates were automatically inferred rather than explicitly provided. In this context, the transmission is dangerous because it can disclose a user's approximate whereabouts without meaningful consent or notice.

Content

Scanner excerpt · map_search.py (reported line 162)May include surrounding context.

python
# 百度（location 格式：纬度,经度）
    if "baidu" in priority and BAIDU_KEY:
        location = f"{lat},{lng}"
        url = f"https://api.map.baidu.com/place/v2/search?query={keyword}&location={location}&radius={radius}&ak={BAIDU_KEY}&output=json"
        try:
            r = requests.get(url, timeout=5).json()
            if r.get("status") == 0:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module description and all CLI output strings are written in Chinese, and there is no indication that users can opt into another language or locale. This creates a locale policy concern because the skill implicitly enforces one language regardless of user preference.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest says the skill is a map search tool, but the code also accesses local configuration under ~/.config and reads environment variables for third-party API keys. While common for implementation, this is still a capability not disclosed by the stated purpose and could matter in constrained agent environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.