other
Warning
- Location
- scripts/amap_ip_locate.js:31
- Finding
- Location Data Is Transmitted to a Third Party Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:155-160`; `references/flow_playbook.md:16-18`; `scripts/amap_ip_locate.js:31-39`; `scripts/amap_geocode.js:19-34` **Vulnerability Type**: Sensitive Location Data Disclosure **Risk Level**: Medium ### Evidence ```javascript async function locateByIp(ip) { const key = process.env.AMAP_WEBSERVICE_KEY || process.env.AMAP_KEY; if (!key) return { error: 'Missing AMAP_WEBSERVICE_KEY (or AMAP_KEY)' }; if (!ip) { return { error: 'Missing --ip. Only use IP locate when you truly have the user IP; otherwise ask user for current location.' }; } try { const resp = await axios.get('https://restapi.amap.com/v3/ip', { params: { key, ip, output: 'JSON' }, timeout: 15000 }); ``` ```javascript const resp = await axios.get('https://restapi.amap.com/v3/geocode/geo', { params: { key, address, city: city || undefined, output: 'JSON' }, timeout: 15000 }); ``` The documented workflow instructs the agent to attempt IP-based positioning first when a real user IP is available, then geocode the user's origin and hospital destination. ### Technical Analysis The routing workflow sends a user's IP address or free-form location description to Amap's external API. Neither the scripts nor the surrounding workflow require an explicit consent decision before this transmission. An IP address, exact address, and derived coordinates are sensitive location data. Their sensitivity is increased in this Skill because the destination is commonly a hospital or medical department. A third party could therefore associate a location with a healthcare-related journey. TLS protects the request in transit but does not eliminate disclosure to the API operator. The API key is also placed in the HTTPS query parameters by Axios, as required by this API integration. ### Attack Path 1. A user asks the Skill to plan a route to a hospital. 2. The runtime or agent context provides the user's IP ...[truncated 961 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit opt-in before sending an IP address, address, or coordinates to Amap. 2. Clearly identify the third-party recipient and enumerate the data that will be transmitted. 3. Prefer a user-supplied coarse origin, such as a transit station or neighborhood, instead of automatically using the user's IP. 4. Do not echo the original IP address in script output unless it is strictly required. 5. Minimize precision before transmission when exact routing is unnecessary. 6. Add a non-network fallback that gives manual instructions for opening Amap. 7. Document expected third-party retention and privacy behavior. 8. Ensure medical details, symptoms, appointment data, and patient identifiers are never included in geocoding requests. ]]>