Amap Lbs Skill

• Outcome: Review
• Latest audit: Jul 18, 2026 · 7:18 AM UTC
• Version: 2.0.1

Overview

The skill is a coherent Gaode/Amap mapping helper, but it needs Review because it bundles an apparent API key and adds mandatory telemetry and local app IPC beyond the core map requests.

Install only if you are comfortable with Amap receiving functional map/API requests plus a telemetry call on each use. Do not rely on the bundled config.json; treat the included key as exposed, replace it with your own environment variable, and review or remove the Python Unix-socket workflow if you do not use the companion Electron app.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill declares no explicit permissions while clearly requiring environment-variable access and outbound network access. This weakens review transparency and can cause the skill to be granted or assumed capabilities without users or reviewers understanding its true execution surface.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior goes beyond the stated mapping/search purpose by including local API key persistence and, per the finding, Unix Domain Socket communication with a local Electron app. Undisclosed local IPC or extra local-side effects materially expand the trust boundary and could expose secrets or influence other local applications unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs sending telemetry on every keyword-search operation before serving the user's request, and this reporting is not necessary to generate a map search link. Even if the payload appears minimal, mandatory undeclared telemetry creates avoidable data disclosure and establishes a pattern of contacting third-party infrastructure for nonessential reasons.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The nearby-search flow requires a telemetry call before geocoding and search-link generation, adding a nonessential external request to a workflow that already handles location-sensitive user input. Because nearby search inherently involves place/location context, extra unsolicited reporting increases privacy risk in a more sensitive context.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The heatmap workflow adds telemetry before generating a visualization link, despite telemetry being unrelated to the core task. Since users may provide external data URLs for visualization, unnecessary reporting alongside such actions increases external exposure and complicates privacy review.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The POI search workflow performs telemetry in addition to the already necessary API request, creating extra third-party communication outside the user-expected search transaction. This broadens the external data-sharing footprint without a functional need and may violate least-privilege/privacy expectations.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Route planning includes nonessential telemetry before the main operation, adding an avoidable outbound request in a workflow that may reveal movement intent between origin and destination. The context makes this more sensitive because route requests can imply travel habits or precise user interests.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Travel-planning telemetry is not inherent to itinerary generation and adds another external contact point in a workflow likely to contain rich behavioral preferences such as cities and interests. The extra reporting expands privacy risk beyond what users reasonably expect from trip-planning assistance.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The trigger keywords are broad enough to activate on ordinary language such as generic uses of 'find', 'search', or 'plan', which can cause the skill to run outside intended map-related contexts. Over-triggering is dangerous here because the skill may then prompt for API keys, perform network calls, or emit telemetry when the user did not intend to invoke a mapping tool.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.13.6"
  }
}

• Confidence: 84% confidence
• Finding: "axios": "^1.13.6"

Known Vulnerable Dependency: axios==1.13.6 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: axios==1.13.6

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:61