Security audit

tencentmap-jsapi-gl-skill

Security checks across malware telemetry and agentic risk

Overview

This Tencent Maps development skill is mostly documentation, but it also handles SMS verification, API-key provisioning, and local storage of phone numbers and keys in ways users should review before installing.

Install only if you are comfortable letting the skill assist with Tencent Maps key onboarding. Treat phone numbers, verification codes, session tokens, and API keys as sensitive; avoid running the tempkey scripts unless you intend to create or reuse a Tencent key, and review or remove ~/.tencentmap/tempkey.json after use if you do not want that data stored locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill metadata declares no explicit permissions, yet the skill instructions require access to environment variables, local files, and external network resources. This creates a transparency and least-privilege problem: users and orchestrators cannot accurately assess or constrain what the skill may access, especially around the sensitive `TMAP_JSAPI_KEY` and local key cache.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a Tencent Maps development guide, but its behavior includes credential acquisition and lifecycle management activities such as authentication flows, API key creation/reuse, and local persistence of phone/key metadata. That mismatch is dangerous because it expands the trust boundary from documentation assistance into account-linked credential handling, which can surprise users and increase the risk of secret exposure, unauthorized key issuance, or unintended account actions.

Context-Inappropriate Capability

Low

Confidence: 96% confidence
Finding: The demo embeds a Tencent Maps API key directly in client-side HTML, making it trivially visible to anyone who loads or inspects the page. Even if intended for example usage, exposed keys can be reused by third parties, leading to quota theft, unauthorized consumption, or account abuse if the key is not tightly restricted.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script explicitly persists API key material and related account metadata to a predictable file under the user's home directory, which is outside the narrow scope of a Tencent Maps development-guidance skill. Storing credentials locally in plaintext increases the chance of unintended disclosure through local compromise, backups, shared accounts, or accidental reuse by other components.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code maintains a local database keyed by phone number and tracks API key status, expiry, and quota without any visible access control, encryption, or strong justification tied to map-development guidance. This creates unnecessary collection and persistence of sensitive identifiers and secrets, broadening privacy and credential-exposure risk if the host or file is accessed by another user or process.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file defines an authentication/SMS verification endpoint and logic to send verification codes, which is unrelated to a Tencent Map JSAPI GL development-guidance skill. This mismatch in capability versus declared purpose is dangerous because it introduces covert account-verification or user-contact functionality that could be abused to send unsolicited OTP/SMS traffic or support unauthorized account workflows.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The function accepts a user-supplied phone number and performs an outbound POST request to send an SMS verification code, enabling direct interaction with external authentication infrastructure. In the context of a map-development guidance skill, this is unjustified and creates abuse potential such as unsolicited SMS sending, OTP spam, or use of the skill as a proxy in account-enrollment or verification flows.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This script performs real key-management actions against Tencent's backend by creating or reusing map keys from a supplied supplement token, which is an operational capability rather than documentation or advisory logic. In an agent skill advertised as development guidance, this enables credential provisioning and account-affecting actions that could be abused to mint or recycle usable API keys, expanding access beyond the stated scope.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The supplement() function directly accepts a token and calls a privileged tempkey supplement endpoint to create or reuse keys, which is not justified by a skill whose purpose is Tencent Map JSAPI GL guidance. Because the skill context is educational/documentation-oriented, embedding live credential-management logic is more dangerous: users and downstream agents may trust the skill as informational while it contains account-modifying behavior.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file’s behavior materially exceeds the declared scope of a Tencent Maps JSAPI GL development guide by directing the agent to collect a phone number, run SMS-based key provisioning, and persist credentials locally. That scope mismatch is dangerous because it can socially normalize sensitive-account operations under the guise of documentation assistance, increasing the chance of unauthorized credential handling or abuse.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The skill instructs the agent to collect a user phone number and drive an SMS verification flow to create or obtain a key, which is not justified by the stated purpose of helping with JSAPI GL development. This creates unnecessary exposure of personal data and enables the agent to participate in identity-linked account actions that users may not reasonably expect from a coding/documentation skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Persisting phone numbers, API keys, and expiry metadata in a local config file is an unjustified secret-storage capability for a development-guide skill and increases the blast radius of compromise on the host. If the local machine, user profile, backups, or logs are accessed by another process or person, those credentials and associated personal data can be exposed or misused.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The guide claims the AI does not need to write files, yet later instructs it to invoke a script that writes configuration locally and marks records expired. This inconsistency can mislead reviewers and users about the skill’s true capabilities, weakening trust boundaries and making risky side effects easier to overlook.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The auto-trigger condition is overly broad, using vague phrases like 'related map development needs,' which can cause the skill to activate outside the user's intended scope. In context, that matters because the skill may inspect environment credentials or direct users into key-handling workflows, so accidental invocation increases unnecessary exposure to sensitive operations.

Vague Triggers

Low

Confidence: 80% confidence
Finding: The auto-trigger condition is overly broad, using vague phrases like 'related map development needs,' which can cause the skill to activate outside the user's intended scope. In context, that matters because the skill may inspect environment credentials or direct users into key-handling workflows, so accidental invocation increases unnecessary exposure to sensitive operations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs checking and using an API key from environment variables or a local file without warning that this is sensitive credential material. In a code-assistance context, that creates a real risk that the key could be surfaced in logs, prompts, generated code, screenshots, or persisted artifacts, enabling abuse of the Tencent Maps account or quota.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The page automatically calls locate() on load and, when no IP is provided, sends the requester's IP to Tencent's geolocation service without an explicit user-facing privacy notice or consent step. IP addresses are personal data in many jurisdictions, and this disclosure to a third party can create privacy/compliance risk even if no script injection or code execution issue exists.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The page takes user-supplied coordinates and sends them to Tencent's reverse-geocoding service, which discloses location data to a remote third party. Even though this is expected for the feature to work, there is no user-facing notice, consent cue, or privacy disclosure in the UI, so users may not realize their entered location is transmitted off-page.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation states that InfoWindow content may be a string and, when enableCustom is true, a DOM string, but provides no warning that injecting untrusted HTML can lead to DOM-based XSS in applications that pass user-controlled content. In a mapping UI, info windows are often populated from POI names, search results, or backend data, so developers may directly render unsanitized input into the page.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: This demo page loads third-party JavaScript directly from remote Tencent domains, which creates a supply-chain trust dependency: if the remote script is modified, compromised, or swapped, arbitrary code would execute in the page. In a reference/demo skill this is common and likely not malicious, but it is still a real security concern because the page gives no integrity pinning, local vendoring, or user disclosure about executing remote code.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This page imports executable JavaScript from a separate remote domain path to provide demo data, so whoever controls that endpoint can run arbitrary code in the page context. In a skill/demo repository, that creates a real supply-chain risk because consumers may copy the pattern into production and the imported file is not constrained to inert JSON data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.