Security audit

tencentmap-map-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Tencent Maps assistant, but it automatically creates/persists shareable map guides, handles phone-based key enrollment, and stores usable keys in ways users should review before installing.

Install only if you are comfortable with Tencent Maps receiving location, POI, route, guide, phone-verification, and key-enrollment data for the requested workflows. Before using it, prefer providing your own scoped Tencent Maps key, avoid public HTML containing keys, and treat ~/.tencentmap/tempkey.json as a sensitive file because it can contain full API keys and phone-linked records. For routine searches or route answers, ask the agent not to generate or save a mini-program guide unless you explicitly want a QR/shareable map.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: references/agent-notes.md:55
Finding: Mandatory Unrequested Guide Creation and Promotional QR Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tmap_client.py:35
Finding: Reusable Guide-Gateway Signing Secret Embedded in Distributed Client Code
Content: View full analysis
Dict[str, str]: """生成 saveandgenqrcode 接口的 HMAC-SHA256 签名头。签名串按字母序拼接（markdown_content 用 base64 原值，不再哈希）： markdown_content=&nonce=<16位>&qimei36=<>×tamp=<秒> X-Sign = HMAC-SHA256(签名串, _SIGN_SECRET) """ timestamp = str(int(time.time())) nonce = "".join(random.choices(string.ascii_letters + string.digits, k=16)) sign_str = ( f"markdown_content={markdown_b64}" f"&nonce={nonce}" f"&qimei36={qimei36}" f"×tamp={timestamp}" ) sign = hmac.new(_SIGN_SECRET.encode(), sign_str.encode(), hashlib.sha256).hexdigest() return { "X-Timestamp": timestamp, "X-Nonce": nonce, "X-Sign": sign, "tmap-userid": _OPERATION_USER_ID, "Content-Type": "application/json", } ``` ### Technical Analysis The package contains a static HMAC signing secret and a fixed operational user identifier. Because the Skill is distributed to clients, any user who can read the package can recover both values. HMAC authentication depends on the signing key remaining secret. Once the key is embedded in client-side code, it cannot distinguish legitimate Skill invocations from independently constructed requests. An attacker can reproduce the documented signing algorithm, choose arbitrary Markdown content, generate a nonce and timestamp, and compute a valid `X-Sign` value. Base64 encoding of guide Markdown does not protect confidentiality or integrity. It is reversible encoding, while integrity is intended to come from the exposed HMAC key. ### ...[truncated 1293 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/save_config.py:36
Finding: Plaintext Storage of API Keys and Phone-Linked Enrollment Records Without Explicit Permission Hardening
Content: View full analysis
dict: config_path = get_config_path() config_dir = os.path.dirname(config_path) records = {} if os.path.exists(config_path): try: with open(config_path, "r", encoding="utf-8") as f: records = json.load(f) except Exception: records = {} existing = records.get(phone, {}) is_new = not (existing.get("key") == key) records[phone] = { "key": key, "expire_time": expire_time, "applied_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"), "status": "active", "is_existing": is_existing, "quota": { "pv_per_day": 5000, "qps": 5, }, } try: os.makedirs(config_dir, exist_ok=True) with open(config_path, "w", encoding="utf-8") as f: json.dump(records, f, ensure_ascii=False, indent=2) return {"is_new": is_new, "write_success": True} except Exception as e: return {"is_new": is_new, "write_success": False, "msg": str(e)} ``` ```python def save_key_to_dotenv(key: str) -> str: tempkey_path = os.path.join(os.path.expanduser("~"), ".tencentmap", "tempkey.json") records = {} if os.path.exists(tempkey_path): try: with open(tempkey_path, "r", encoding="utf-8") as f: records = json.load(f) except Exception: records = {} if not isinstance(records, dict): records = {} records["__manual__"] = {"key": key, "status": "active", "source": "manual"} os.makedirs(os.path.dirname(tempkey_path), exist_ok=True) with open(tempkey_path, "w", encoding="utf-8") as f: json. ...[truncated 2552 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (377)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Backend creation or reuse of API/temp keys, along with supplement tokens and mkeys, goes beyond end-user mapping features and enters credential lifecycle management. When this is not clearly disclosed, the skill can become a covert credential broker, enabling unauthorized provisioning, misuse of API quotas, or transfer of control over service credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Backend creation or reuse of API/temp keys, along with supplement tokens and mkeys, goes beyond end-user mapping features and enters credential lifecycle management. When this is not clearly disclosed, the skill can become a covert credential broker, enabling unauthorized provisioning, misuse of API quotas, or transfer of control over service credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Backend creation or reuse of API/temp keys, along with supplement tokens and mkeys, goes beyond end-user mapping features and enters credential lifecycle management. When this is not clearly disclosed, the skill can become a covert credential broker, enabling unauthorized provisioning, misuse of API quotas, or transfer of control over service credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Backend creation or reuse of API/temp keys, along with supplement tokens and mkeys, goes beyond end-user mapping features and enters credential lifecycle management. When this is not clearly disclosed, the skill can become a covert credential broker, enabling unauthorized provisioning, misuse of API quotas, or transfer of control over service credentials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The reference file documents SMS-based verification, session tokens, supplement tokens, and temporary API key issuance flows that are unrelated to a normal end-user map assistant. In the context of a skill advertised for route planning and map assistance, exposing account-linked key provisioning capabilities expands the skill into credential and quota management, creating a pathway for unauthorized key acquisition or abuse if the skill invokes these flows on behalf of users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Including account verification and API key provisioning in a map-assistant skill creates an unjustified privilege boundary crossing: a conversational mapping tool should not normally collect phone numbers, process SMS codes, and mint or reuse API keys. This mismatch makes the skill more dangerous because an LLM-driven assistant could be used to social-engineer users into providing verification data or trigger key lifecycle operations outside the expected travel-assistance scope.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/jsapi-guide/jsapigl/demos/地图操作示例.md (reported line 519)May include surrounding context.
md
<div id="container"></div> <script src="https://mapapi.qq.com/web/jsapi/jsapi-gl/js/dom-to-image.min.js"></script>  <script src="https://map.qq.com/api/gljs?v=1.exp&key={TMAP_JSAPI_KEY}"></script> <script> var map = new TMap.Map('container', {

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/jsapi-guide/jsapigl/demos/地图操作示例.md (reported line 519)May include surrounding context.
md
<div id="container"></div> <script src="https://mapapi.qq.com/web/jsapi/jsapi-gl/js/dom-to-image.min.js"></script>  <script src="https://map.qq.com/api/gljs?v=1.exp&key={TMAP_JSAPI_KEY}"></script> <script> var map = new TMap.Map('container', {

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/jsapi-guide/jsapigl/docs/矢量图形.md (reported line 464)May include surrounding context.
md
<br><br> ## MVTLayer{#MVTLayer} -------     用于创建符合mapbox-vector-tile标准的图层对象，叠加在地图上进行显示；**注意，添加MVTLayer后不支持地图设置中心点偏移**。 | 构造函数 |

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/jsapi-guide/jsapigl/docs/附加库：矢量数据图层.md (reported line 38)May include surrounding context.
md
<br><br> ## MVTLayer{#MVTLayer} -------     用于创建符合mapbox-vector-tile标准的图层对象，叠加在地图上进行显示；**注意，添加MVTLayer后不支持地图设置中心点偏移**。 | 构造函数 |

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes map, routing, POI, weather, geocoding, and itinerary-related Tencent Map capabilities. This script implements phone-based authentication by sending SMS verification codes and returning a session token, which is an account/auth workflow rather than a user-facing map assistant capability described in the manifest.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tmap_client.py (reported line 152)May include surrounding context.
python
def _read_legacy_dotenv_key() -> Optional[str]: """向后兼容：读取旧版 skill 包内 .env 的 TMAP_KEY，仅用于一次性迁移。 """ skill_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tmap_client.py (reported line 185)May include surrounding context.
python
def _read_legacy_dotenv_key() -> Optional[str]: """向后兼容：读取旧版 skill 包内 .env 的 TMAP_KEY，仅用于一次性迁移。 """ skill_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tmap_client.py (reported line 211)May include surrounding context.
python
def _read_legacy_dotenv_key() -> Optional[str]: """向后兼容：读取旧版 skill 包内 .env 的 TMAP_KEY，仅用于一次性迁移。 """ skill_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tmap_client.py (reported line 156)May include surrounding context.
python
""" skill_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) env_path = os.path.join(skill_root, ".env") if not os.path.exists(env_path): return None try:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README claims the skill can be invoked with broad natural language for many map-related tasks, but it does not define clear trigger boundaries, constraints, or disambiguation rules. In an agent ecosystem, this can cause overbroad activation, unintended tool use, and unnecessary transmission of user queries or location-related data to external services.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 76% confidence
Finding: The skill documentation describes capabilities that rely on network access, filesystem reads/writes, and environment-backed key persistence, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can cause over-broad invocation and make sensitive operations like reading reference files, writing output artifacts, and persisting API keys occur without clear least-privilege constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description uses broad natural-language trigger conditions for many common travel and location requests, which increases the chance of over-invocation. In a skill that also appears to manage keys and possibly sensitive auth flows, loose trigger boundaries raise the risk that the agent activates this skill in contexts where the user did not intend to authorize its broader behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Claiming the skill can be used with 'one sentence of natural language' without defining boundaries encourages indiscriminate activation across a wide range of user requests. Because the skill includes file, network, and persistence-related operations, this ambiguity can lead to unintended handling of user data or credentials during otherwise ordinary conversation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The notes instruct the agent to run pip install requests when a dependency is missing. Allowing a skill to trigger package installation expands its authority from using an existing map client to modifying the runtime environment and executing package-manager side effects, which can introduce supply-chain risk or unexpected code execution paths. In this context, the map-assistant purpose does not require autonomous dependency installation, so the instruction is overly permissive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states that all WebService capabilities default to returning semantic text in Chinese (中文) and instructs the agent not to reformat it. This imposes a specific language on outputs without indicating user opt-in or a justified region-specific language policy.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill directs the agent to execute OS-level file copy commands (cp/copy) to place QR PNGs into the workspace. This is a real security concern because it authorizes shell/file-system mutation beyond answering mapping queries, and it normalizes command execution on paths derived from tool output without clear confinement guarantees. The travel-guide context partially explains why a file might be preserved, but it does not justify requiring shell commands instead of safer platform file APIs and explicit user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The notes instruct the agent to write a QR PNG into the current workspace but provide no requirement to notify the user or obtain consent. Silent file creation is risky because it changes persistent state and may surprise users, clutter workspaces, or be abused as a precedent for broader unauthorized writes. The map-assistant context makes the write somewhat related to functionality, but persistence should still be disclosed and optional.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api_reference.md (reported line 91)May include surrounding context.
请求示例

bash
curl -s -X POST 'https://lbsconsole.map.qq.com/nosession/http/skill/auth/send-code' \ -H 'Content-Type: application/json' \ -H 'X-Skill-Nonce: abc123def456' \ -H 'X-Skill-Timestamp: 1752662400' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document shows example session tokens and API key values without any accompanying handling guidance, which normalizes exposing secrets in plaintext within skill materials. In an LLM skill context, examples that resemble live credentials can lead developers or users to paste real tokens or keys into prompts, logs, chat transcripts, or generated code, increasing leakage risk.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/jsapi-guide/README.md:132

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Description-Behavior Mismatch

Context-Inappropriate Capability

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Description-Behavior Mismatch

Credential Access

Credential Access

Credential Access

Credential Access

Vague Triggers

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Context-Inappropriate Capability

Natural-Language Policy Violations

Context-Inappropriate Capability

Missing User Warnings

External Transmission

请求示例

Missing User Warnings

Static analysis

File appears to expose a hardcoded API secret or token.