tencentmap-map-assistant

• Outcome: Review
• Latest audit: Aug 12, 2026 · 9:10 AM UTC
• Version: 1.5.2

Overview

The skill is a real Tencent Maps assistant, but it also performs sensitive phone-based API key creation and stores phone-linked keys locally in plaintext.

Review this before installing if you are not comfortable giving the skill a phone number, creating or reusing Tencent Maps API keys, sending location and trip data to Tencent services, or storing a phone-linked API key in plaintext under ~/.tencentmap/tempkey.json. Prefer a dedicated Tencent Maps key with limited scope, monitor quota usage, and delete or rotate saved keys if you stop using the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes behaviors requiring environment access, file read/write, and network use, yet no permissions are explicitly declared. This creates a transparency and consent problem: an agent may invoke a skill that persists keys, reads local guidance files, and calls external services without clear permission boundaries, increasing the risk of unintended data exposure or overbroad execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a substantial description-behavior mismatch: the skill presents itself as a mapping/travel assistant, but the analysis indicates it also handles phone-based verification, temporary key creation/reuse, token supplementation, and local persistence of phone-to-key records with status/quota metadata. Hidden credential lifecycle management and phone-number handling materially expand the privacy and security footprint, and could surprise users or host agents into exposing secrets, personal data, or unauthorized API access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to run `pip install requests` when an import fails. Allowing a skill to trigger package installation expands the agent's execution and supply-chain attack surface beyond the core map-assistant purpose, and can lead to environment modification or installation of unintended code in shared or sensitive runtimes.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill requires copying a generated QR PNG into the current workspace via shell commands. This grants the skill an unnecessary file-write side effect for a map assistant, creating risk of unauthorized filesystem modification, path misuse, or abuse of agent file-management capabilities if output paths are influenced or if the workspace contains sensitive material.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The reference material documents SMS verification, temporary API key issuance, quota expansion, and key reuse workflows that are materially different from the advertised end-user map assistant purpose. In a skill context, exposing credential-issuance and quota-management capabilities creates a pathway for the agent to facilitate developer account actions and secret handling beyond least privilege, which can be abused for unauthorized key creation, quota consumption, or account misuse.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: Including phone verification plus developer key and quota management is not justified by the stated travel-assistant use case and significantly broadens the skill's operational scope. This increases the risk that the skill collects sensitive identifiers and helps obtain or modify API credentials for users, enabling account abuse or unauthorized access under the guise of a benign mapping assistant.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script stores a phone-number-to-API-key mapping in a predictable plaintext file under the user's home directory without encryption, permission hardening, or minimization. This creates a real local secret-storage weakness: any local process or user with access to that profile can recover the API key and associated phone metadata, and the map-assistant context does not justify persisting credentials in this broad form.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This script is explicitly designed to create or reuse Tencent map API keys via a supplement token, which is a credential-management operation rather than an end-user map assistant feature. In the context of a travel/map skill, bundling hidden key provisioning logic increases the risk of unauthorized credential issuance, abuse of platform resources, and covert expansion of access beyond what users expect.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The implementation performs backend credential supplementation against a tempkey endpoint instead of map, routing, or location operations described by the skill metadata. This functionality mismatch is dangerous because it hides a privileged backend capability inside a seemingly benign travel assistant, making review, user consent, and least-privilege enforcement harder.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that `ip_location(ip=None)` will locate the caller's public IP when no IP is provided, but this behavior is only briefly mentioned and not accompanied by a clear, prominent privacy warning or consent guidance at the API point of use. In a travel/location skill, silently resolving a user's public IP can expose approximate location data without explicit user awareness, which creates avoidable privacy risk and potential misuse in agent-driven workflows.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The skill advertises extremely broad natural-language invocation conditions covering many travel, route, weather, coordinate, and mapping scenarios. Overbroad triggers raise the chance of unnecessary activation in contexts involving location data or file generation, which can lead to unintended external requests or disclosure of sensitive user context to the skill backend.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill tells the agent to create a file in the workspace without any user-facing disclosure or consent. Even when the file is benign, silent file creation violates least surprise and can be chained with other behaviors to persist artifacts or consume storage without the user's knowledge.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The document instructs transmission of a user's phone number and returns a session token, but provides no explicit privacy, storage, masking, retention, or redaction guidance. In an agent skill environment, this omission is dangerous because logs, prompts, telemetry, or downstream tools may inadvertently retain sensitive personal data and authentication tokens.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document specifies that full API keys are created and returned, including in key lists, without any warning or control guidance for secrets handling. In a skill context this is especially risky because generated credentials could be exposed to users, logs, model context, browser rendering, or third-party integrations, leading to credential theft and misuse of Tencent map services.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The page automatically calls locate() on load and, when no IP is entered, sends the requester’s IP to Tencent’s remote geolocation service without a clear privacy notice or explicit consent flow. While this is expected functionality for an IP-location demo, it still transmits location-derived personal data to a third party and may surprise users or violate privacy expectations or policy requirements.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The code fetches district data using JSONP, which executes returned data as script in the page context rather than treating it as inert JSON. If the upstream endpoint, transit path, or callback handling is compromised, this can become arbitrary script execution in the origin of the page, making it materially more dangerous than a normal cross-origin data fetch.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The page enumerates detailed browser and device characteristics, including the full user agent, and displays them without any notice, consent prompt, or privacy explanation. Even though this demo only renders the values locally, such data can support fingerprinting and can be easily repurposed for tracking or profiling, making the lack of disclosure a genuine privacy issue.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends a supplement_token and optional mkey to a remote service, and these values are sensitive because they can enable key reuse or creation. Even though the transport uses HTTPS, the absence of clear warnings, secure secret-handling guidance, or controls around how these secrets are supplied and logged increases the chance of accidental disclosure through shell history, process lists, automation logs, or misuse by operators.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The ip_location method can send the caller's IP to Tencent's geolocation service without any user-facing disclosure or consent prompt. IP addresses are personal data in many jurisdictions, and silent transmission to a third party creates privacy and compliance risk even if it is functionally expected for the feature.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Travel guide generation transmits precise latitude and longitude in the A2A request metadata to a remote service, but the code provides no notice, consent, or minimization. Precise location is highly sensitive; in a travel assistant context this increases privacy risk because it can reveal where the user currently is while requesting itinerary generation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs the agent to store a user's phone number and Tencent map key in a local config file as part of the normal flow, but the user-facing protocol text only covers service and privacy agreements for key issuance and does not clearly disclose local persistence on the device. This creates a privacy and secret-handling risk because personally identifiable information and an API credential are written to disk without explicit, informed consent or minimization, increasing exposure if the host is multi-user, backed up, or compromised.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 腾讯位置服务地图助手 Skill 依赖
# 安装：pip install -r requirements.txt
requests>=2.25.1

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower-bound constraint only, which makes builds non-reproducible and allows installation of different versions over time. This increases supply-chain risk and can unintentionally pull in a vulnerable or breaking release depending on when and where the skill is installed.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/jsapi-guide/README.md:132