Amap Citywalk Mystery

• Outcome: Review
• Latest audit: Jun 25, 2026 · 1:57 PM UTC
• Version: 0.1.10

Overview

The skill matches its city-walk game purpose, but it needs review because it collects precise location and photos through a custom service without enough privacy, retention, or safety controls.

Review before installing. Use this only if users knowingly agree to share precise GPS location, on-site photos, answers, and game progress with the hosted service. Ask the publisher for privacy, retention, deletion, and access-control details, avoid photographing bystanders or private areas, and remove scripts/.location-session after use if location sessions should not remain on disk.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as an Amap-based CityWalk experience, but the behavior described relies heavily on an additional external backend service for GPS sessions, check-ins, question verification, story state, and scoring. This hidden expansion of trust boundaries means sensitive location, images, answers, and gameplay telemetry may be sent to a non-obvious third party, undermining informed consent and increasing the attack surface.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README makes GPS location sharing and on-site photo upload mandatory for progression, but it does not warn users about privacy exposure, bystander capture, metadata leakage, or the risks of sharing precise real-time location. In a skill centered on real-world movement and photo collection, this omission can lead users to disclose sensitive location and image data without informed consent or safer alternatives.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill encourages users to walk through real urban environments and only unlock progress after physically reaching locations, yet the README provides no safety guidance about situational awareness, traffic, restricted areas, weather, nighttime travel, or personal security. Because the core experience depends on real-world navigation, missing safety warnings materially increases the chance that users will prioritize game progression over safe behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to click links that automatically collect GPS and to upload on-site photos, but it does not provide a clear privacy notice explaining what data is collected, where it is sent, how long it is stored, and who can access it. Exact location plus user images can reveal highly sensitive personal information, including home/work patterns, companions, and timestamps of movement.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The instruction to prompt users every 10-15 seconds until location is completed creates tracking-like pressure and normalizes persistent collection behavior without an accompanying warning or consent boundary. Even if framed as UX guidance, repeated polling around GPS acquisition can be coercive and may desensitize users to continuous location requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script persists a location session identifier to a predictable local file without notice, consent, access controls, or cleanup. If another local process or user can read that file, they may reuse the session to query location results and access sensitive geolocation data tied to the user flow.

Hidden Instructions

High

• Category: Prompt Injection

Content

</defs>
  <rect width="800" height="520" fill="url(#bg)"/>
  
  <!-- Title -->
  <text x="400" y="40" text-anchor="middle" fill="#ffd700" font-size="24" font-weight="bold">🏗️ 技术架构 · AI CityWalk 剧本杀</text>
  
  <!-- User Layer -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "sunfj",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.18.1"
  }
}

• Confidence: 95% confidence
• Finding: The dependency uses a caret range (^1.18.1), which permits automatic installation of newer compatible axios releases rather than a single audited version. This increases supply-chain risk because builds may resolve to different package contents over time, including a compromised or breaking upstream release, though the package.json alone does not indicate active exploitation.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:17

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/api-client.js:38