Security audit

tencentmap-miniprogram-skill

Security checks for vulnerabilities and agentic risk

Overview

This map-development skill also runs phone verification, creates or reuses Tencent Map API keys, and stores phone-linked keys locally, so it needs Review before installation.

Install only if you are comfortable with the skill helping an agent obtain a Tencent Map temporary key. Prefer setting your own TMAP_JSAPI_KEY and avoid the temp-key flow unless you consent to sending a phone number and SMS code to Tencent and storing the resulting key locally in plaintext.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no explicit permissions, yet its documented behavior requires access to environment variables, local files, and network resources. This creates a transparency and least-privilege problem: a user or platform may invoke the skill expecting passive documentation guidance, while it can also read secrets, persist state, and contact external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose is documentation and development guidance for Tencent Maps, but the behavior extends into account-linked operational actions such as SMS verification, console authentication, temporary key creation/reuse, and writing key state into the user's home directory. That mismatch is dangerous because it can cause users or orchestration systems to trust and auto-run a seemingly informational skill that actually performs sensitive identity, credential, and persistence operations.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This script persists phone numbers and API keys together in a predictable plaintext file under the user's home directory, creating a local secret-and-PII store. Even if intended for convenience, that capability is outside the stated map-development guidance scope and increases the chance of credential disclosure through local compromise, backups, logs, or accidental sharing.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code writes phone-linked API key records to disk in JSON without encryption or access-control hardening, making sensitive credentials and identifying data available to any process or user with filesystem access. Because the skill is supposed to assist with Tencent Map development rather than account/credential management, this hidden persistence is harder for users to anticipate and more dangerous in context.

Context-Inappropriate Capability

Low

Confidence: 74% confidence
Finding: The script can modify stored lifecycle state by marking a phone record as expired, which indicates the skill is maintaining local account/key state beyond pure map-development assistance. By itself this is not severe, but it expands the unauthorized state-management surface and can be abused to tamper with local records or conceal prior key usage if another component relies on this file.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script implements SMS verification code sending functionality even though the skill is ներկայացված as Tencent Map JSAPI GL development guidance. That scope mismatch is dangerous because it introduces authentication-related behavior and collection/use of phone numbers unrelated to the declared purpose, which can enable covert account-binding, unsolicited SMS triggering, or abuse of user trust within an unrelated skill.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code makes outbound phone-authentication requests to a Tencent endpoint and returns a session token, despite the skill being framed as map API development guidance. In this context, hidden or unjustified auth flows are risky because they can be used to initiate account-related actions, create unauthorized sessions, or exfiltrate sensitive identifiers under the guise of an unrelated developer tool.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: This script materially exceeds a documentation/advisory skill’s stated purpose by providing an operational capability to create or reuse Tencent map keys. Even if intended for legitimate setup, embedding credentialed key provisioning inside a skill increases the chance of unauthorized account actions, secret misuse, and abuse of downstream paid API resources.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code performs authenticated remote provisioning against a Tencent endpoint using a supplement token and can create new keys or reuse existing ones. In the context of a map-development guidance skill, this is dangerous because it enables real account mutation and issuance of usable API credentials, which could be abused for unauthorized access, quota consumption, billing exposure, or persistence.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file substantially broadens a map-development guidance skill into an operational account-onboarding and temporary API key issuance workflow, including SMS verification, token handling, branching state, and local persistence. That creates an unnecessary privilege and data-handling surface unrelated to code guidance, increasing the chance the agent will collect personal data and manage credentials beyond its declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to perform identity verification and credential-management tasks even though the skill is described as a map API development guide. This mismatch violates least privilege and makes it easier for an agent invoked for benign coding help to start collecting phone numbers, handling verification codes, and brokering API credentials.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The document directs persistent local storage of phone numbers and API keys in a predictable config file path, even though that data is sensitive and unrelated to a pure coding-assistance skill. Storing plaintext identifiers and credentials locally increases exposure to other local users, malware, backups, and accidental disclosure, especially if file permissions are not strictly controlled.

Intent-Code Divergence

High

Confidence: 88% confidence
Finding: The file claims the AI does not need to write files, but later requires invoking a persistence script that writes sensitive data locally. This contradiction can mislead reviewers about the skill's real capabilities and conceal that it performs durable storage of credentials and personal data.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The auto-trigger condition is very broad, covering almost any mention of Tencent Maps or related map-development topics. In combination with the skill's ability to access env, files, and network and its key-management workflow, this increases the chance of unintended activation and execution of sensitive side effects in contexts where the user only wanted advice.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The page automatically performs an IP geolocation request on load and also lets a user submit arbitrary IPs to a third-party mapping service without any explicit privacy notice or consent flow. IP addresses are personal data in many contexts, and transmitting them to an external provider can create privacy/compliance risk even if no script injection or code execution issue is present.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The example embeds a third-party script from map.qq.com and includes an API key directly in the URL, but the documentation does not warn that loading it initiates external network requests and exposes usage metadata, referrer information, and the key to the third party. In a developer skill, this can lead users to copy the pattern into production without understanding privacy, supply-chain, and key-management implications.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: This example dynamically injects a remote script tag for a third-party API and passes a callback plus API key in the URL, yet it provides no disclosure about the resulting outbound network access or key exposure. Dynamic loading can also normalize less-reviewable script inclusion patterns, increasing supply-chain risk if copied into real applications.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This documentation explicitly describes IP-based location and geocoding features that process location-related data, but it provides no warning about privacy implications, user consent, retention, or transmission to Tencent services. In a developer skill, that omission can lead integrators to collect and send sensitive location data without appropriate disclosure or safeguards, increasing privacy and compliance risk.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: This page loads third-party JavaScript directly from remote Tencent domains at runtime, which creates a supply-chain trust dependency and allows code changes outside the local skill package to execute in the browser. In a demo/reference skill this is common and likely benign, but if the remote resource is modified, unavailable, or intercepted in a compromised environment, users could be exposed to unexpected script execution or privacy-impacting requests without notice.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: This demo loads JavaScript from third-party remote URLs at runtime, which creates a supply-chain trust boundary outside the local skill content. If the remote provider is compromised, the script changes unexpectedly, or the connection is intercepted in a weak environment, arbitrary code could execute in the page with the same privileges as the application.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script transmits the supplied phone number to a remote endpoint without any explicit warning, consent prompt, or disclosure in the runtime behavior. This is dangerous because phone numbers are sensitive personal data, and silent transmission from a skill whose stated purpose is map development increases the likelihood of privacy violations and deceptive collection.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script transmits a sensitive supplement token and optional mkey to a remote service without any interactive disclosure, confirmation, or guidance about the sensitivity of those values. Although sent over TLS, the lack of user-facing warning increases the risk that operators paste production secrets into an unreviewed helper script, leading to unintended credential exposure or account changes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow instructs the agent to collect and transmit a user's phone number for SMS verification based only on implied consent through linked policies. That is insufficiently explicit for handling personal data, particularly in an agent context where users may not realize their number is being sent to external services and retained in local state.

Static analysis

No suspicious patterns detected.