tencentmap-miniprogram-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:50 AM UTC
• Version: 1.0.4

Overview

This skill is mainly Tencent Maps documentation, but it also performs account-linked key enrollment using your phone and SMS code and stores the resulting key locally in plaintext.

Review this skill before installing if you only wanted documentation. Use it only if you are comfortable with an agent asking for your phone number and SMS verification code, contacting Tencent LBS endpoints, creating or reusing API keys, and saving phone/key records locally. Prefer setting your own TMAP_JSAPI_KEY and avoid sharing OTPs or generated keys in chat, logs, screenshots, or copied demo code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: tencentmap-jsapi-gl-skill/scripts/save_config.py:54

Finding

Sensitive credentials and personal data are exposed through command-line arguments and insecure plaintext storage

Content

View full analysis

3 else "" ``` The workflow explicitly places credentials in command arguments: ```bash python3 scripts/create_key.py python3 scripts/supplement_key.py reuse python3 scripts/save_config.py ``` ### Technical Analysis The workflow handles several sensitive values: - A user's phone number - A six-digit SMS verification code - A short-lived session token - A short-lived supplement token - A Tencent Maps API key Passing these values through `sys.argv` exposes them to any system facility that records or can inspect process command lines. Depending on the execution environment, this may include process-monitoring tools, audit ...[truncated 2420 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: tencentmap-jsapi-gl-skill/references/jsapigl/demos/地图操作示例_创建地图.html:10

Finding

A hardcoded Tencent Maps API key is distributed across executable demos and documentation

Content

View full analysis

``` The same key is also appended to a WebService request: ```javascript url += "&key=OB4BZ-D4W3U-B7VVO-4PJWW-6TKDJ-WPB77"; // Development key ``` Another example embeds it directly in a district WebService endpoint: ```javascript url: "https://apis.map.qq.com/ws/district/v1/getchildren?key=OB4BZ-D4W3U-B7VVO-4PJWW-6TKDJ-WPB77&output=jsonp&get_polygon=2&max_offset=3000", ``` ### Technical Analysis A single concrete API key appears throughout the bundled demos and documentation. Client-side JavaScript map keys are necessarily visible to browsers, but they must still be scoped and restricted appropriately. Committing and redistributing the same key across 171 locations makes extraction trivial and encourages users to copy it into new applications. The risk is increased because the key is not used exclusively to load the browser map library. At least some examples use it with Tencent Maps WebService endpoints. If the key remains active and lacks effective domain, IP, API, or quota restrictions, an unaffiliated party can use it outside the intended demonstrations. The audit did not establish whether the key is currently active or what server-side restrictions are attached to it ...[truncated 1206 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: tencentmap-jsapi-gl-skill/references/jsapigl/demos/地图操作示例_地图导出图片.html:49

Finding

HTML demos execute mutable remote JavaScript without integrity verification

Content

View full analysis

``` ```html ``` ```html ``` Visualization examples also load remote JavaScript data files: ```html ``` None of these tags include Subresource Integrity metadata. ### Technical Analysis A remote `

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (343)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The analyzer indicates the skill can create or reuse Tencent Map keys via backend APIs and interact with lbsconsole.map.qq.com using tokens and provisioning parameters, while claiming to be only a JSAPI GL guide. This mismatch is dangerous because it can lead to silent key provisioning or account-linked operations under the guise of normal documentation assistance, potentially exposing billing, quota, or account assets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The analyzer indicates the skill can create or reuse Tencent Map keys via backend APIs and interact with lbsconsole.map.qq.com using tokens and provisioning parameters, while claiming to be only a JSAPI GL guide. This mismatch is dangerous because it can lead to silent key provisioning or account-linked operations under the guise of normal documentation assistance, potentially exposing billing, quota, or account assets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The analyzer indicates the skill can create or reuse Tencent Map keys via backend APIs and interact with lbsconsole.map.qq.com using tokens and provisioning parameters, while claiming to be only a JSAPI GL guide. This mismatch is dangerous because it can lead to silent key provisioning or account-linked operations under the guise of normal documentation assistance, potentially exposing billing, quota, or account assets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The analyzer indicates the skill can create or reuse Tencent Map keys via backend APIs and interact with lbsconsole.map.qq.com using tokens and provisioning parameters, while claiming to be only a JSAPI GL guide. This mismatch is dangerous because it can lead to silent key provisioning or account-linked operations under the guise of normal documentation assistance, potentially exposing billing, quota, or account assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation explicitly shows and returns full API key values and even states full key values are returned, with no warning that they are sensitive credentials. In an agent-skill context, this increases the chance that generated apps, logs, chat transcripts, screenshots, or downstream tooling will expose reusable secrets, enabling unauthorized API use or quota abuse.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · tencentmap-jsapi-gl-skill/references/jsapigl/docs/矢量图形.md (reported line 464)May include surrounding context.

md

<br><br>
## MVTLayer{#MVTLayer}
-------
​&nbsp;&nbsp;&nbsp;&nbsp;用于创建符合mapbox-vector-tile标准的图层对象，叠加在地图上进行显示；**注意，添加MVTLayer后不支持地图设置中心点偏移**。


| 构造函数                                            |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · tencentmap-jsapi-gl-skill/references/jsapigl/docs/附加库：矢量数据图层.md (reported line 38)May include surrounding context.

md

<br><br>
## MVTLayer{#MVTLayer}
-------
​&nbsp;&nbsp;&nbsp;&nbsp;用于创建符合mapbox-vector-tile标准的图层对象，叠加在地图上进行显示；**注意，添加MVTLayer后不支持地图设置中心点偏移**。


| 构造函数                                            |

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script defines an authentication SMS endpoint and is clearly capable of sending verification codes to arbitrary phone numbers, which is unrelated to the declared purpose of a Tencent Map JSAPI GL development-guide skill. This mismatch is dangerous because it introduces hidden account/authentication functionality into a documentation-oriented skill, enabling abuse for unsolicited SMS delivery, account probing, or unauthorized auth flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This function performs an out-of-scope authentication action by POSTing a user-supplied phone number to a remote send-code endpoint and returning a session token on success. In the context of a map-development guidance skill, this is especially suspicious because it gives the skill the ability to trigger real-world SMS messages and participate in account login or verification flows unrelated to its stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is directed to solicit phone numbers and SMS verification codes and then use them to perform account-linked actions, which is a high-risk identity-verification capability outside the stated role of a map API development guide. Handling OTPs in chat can enable account takeover or social-engineering abuse if the workflow is triggered in the wrong context or by a confused user.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Claude Desktop (local)

• Skills directory is usually: ~/.claude/skills/
• Register via symlink (recommended):

  bash

  ln -sfn "$(pwd)/tencentmap-jsapi-gl-skill" ~/.claude/skills/tencentmap-jsapi-gl-skill
  

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the assistant will use the skill when questions mention “Tencent Map”, “TMap”, “jsapi-gl”, or similar. The phrase “or similar” leaves the activation scope undefined and the listed triggers are broad enough to match many ordinary conversations about mapping, making unintended invocation more likely.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README_zh.md (reported line 28)May include surrounding context.

Claude Desktop（本地）

• Skills 目录一般为：~/.claude/skills/
• 注册（软链，推荐）：

  bash

  ln -sfn "$(pwd)/tencentmap-jsapi-gl-skill" ~/.claude/skills/tencentmap-jsapi-gl-skill
  

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README_zh.md (reported line 28)May include surrounding context.

Claude Desktop(本地)

• Skills 目录一般为:~/.claude/skills/
• 注册(软链,推荐):

  bash

  ln -sfn "$(pwd)/tencentmap-jsapi-gl-skill" ~/.claude/skills/tencentmap-jsapi-gl-skill
  

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill metadata indicates access to an environment variable and the instructions direct the agent to read local files and potentially perform network-backed key acquisition, but the skill does not declare an explicit tool scope or permission boundary. That creates an unnecessary privilege ambiguity: an agent may infer it is allowed to read files, handle credentials, and contact external services without the user clearly consenting to those capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The automatic trigger is broad enough to activate on many generic map-related conversations, which increases the chance that the skill will run in contexts where its credential, file, or network-related behavior is not appropriate. Over-broad triggering is especially risky here because the skill appears to do more than passive documentation lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill references API keys and IP-location capabilities without clear warnings about credential handling, privacy, retention, or external transmission. In context, this is more dangerous because the skill also appears to include key-management and account-related behaviors, so omission of privacy/security disclosure can mislead users into sharing sensitive data too casually.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file describes sending a mainland China phone number to the service and returning a session token, but it does not warn users that personal contact data will be transmitted to a remote Tencent endpoint. Under the markdown-specific SQP-2 criteria, descriptions affecting user privacy should disclose that behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tencentmap-jsapi-gl-skill/references/api_reference.md (reported line 91)May include surrounding context.

请求示例

bash

curl -s -X POST 'https://lbsconsole.map.qq.com/nosession/http/skill/auth/send-code' \
  -H 'Content-Type: application/json' \
  -H 'X-Skill-Nonce: abc123def456' \
  -H 'X-Skill-Timestamp: 1752662400' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tencentmap-jsapi-gl-skill/references/api_reference.md (reported line 294)May include surrounding context.

请求示例 1：action=reuse（复用老 Key 补额）

bash

curl -s -X POST 'https://lbsconsole.map.qq.com/nosession/http/skill/v2/tempkey/supplement' \
  -H 'Content-Type: application/json' \
  -H 'X-Skill-Nonce: reuse001' \
  -H 'X-Skill-Timestamp: 1752662460' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The input handler automatically sends the user's typed keyword together with the current map center to the suggestion service on every input event. While the demo mentions entering a key and using search, it does not warn users in code comments or visible messaging that their input and location context are transmitted to a remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The search function sends the entered keyword and current map bounds to the external search API, which may reveal user intent and geographic context. The file lacks a warning, comment, or user-visible disclosure explaining this network behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The page sends user-entered address data to Tencent's external geocoding service without clearly informing the user that their input will leave the local page and be processed by a third party. Addresses can contain precise location or personal information, so this creates a privacy and compliance risk, especially if reused in real applications without notice or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This HTML/JavaScript file performs a network call via geocoder.getAddress({ location: location }), transmitting coordinates entered by the user to Tencent's mapping service. The code does not provide any explicit warning, confirmation, or privacy disclosure near the action beyond the generic UI label, so users are not informed that their location data is being sent off-device.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The searchClick function takes user-entered text and sends it to the Tencent Maps place search endpoint. The page describes the feature but does not warn users that their search terms will be transmitted to an external service, which is a privacy-relevant network operation.

Content

No source excerpt is available for this finding.