Security audit

腾讯地图WebserviceAPI开发技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Tencent Map development helper, but it also runs an account-linked SMS and API-key provisioning flow that stores phone-linked key data locally, so users should review it before installing.

Install only if you are comfortable letting the assistant help obtain a Tencent Map temporary key. Before using the no-key flow, expect to provide a phone number and SMS code, have tokens and key values handled during the conversation, and have the resulting key stored locally in plaintext under ~/.tencentmap/tempkey.json. Prefer setting your own TMAP_JSAPI_KEY manually if you do not want the assistant to run account-linked provisioning or store phone-linked key records.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill metadata declares no explicit permissions, yet the content indicates use of environment variables, local file access, and likely network-backed key acquisition flows. This creates a transparency and consent gap: an agent or reviewer may assume the skill is documentation-only, while it can access secrets and persist data locally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is API guidance, but the behavior includes operational key management, SMS verification workflows, and persistence of credential state in ~/.tencentmap/tempkey.json. That mismatch is dangerous because users may invoke a seemingly harmless documentation skill without realizing it can trigger account-linked actions, handle sensitive authentication material, or leave recoverable local artifacts.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The reference file is materially misaligned with the advertised Tencent Map JSAPI GL development purpose: instead of map SDK usage guidance, it documents SMS-based verification, token handling, temporary key issuance, and quota supplementation flows. In a skill intended to assist coding or review, this broadens the capability into credential acquisition and account/quota operations, which can steer an agent toward handling sensitive authentication material and enabling actions unrelated to normal map application development.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill includes end-to-end instructions for sending SMS codes, validating session tokens, selecting existing keys, creating new keys, and supplementing quotas, all of which are privileged operational workflows rather than ordinary API-integration guidance. In the context of an agent skill, this can enable abuse such as automating key acquisition, exposing sensitive tokens/keys in prompts or logs, or assisting users in performing account-affecting actions outside the stated map-development use case.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file implements SMS verification code delivery and returns a session token, which is unrelated to a Tencent Map JSAPI GL development-guide skill. That mismatch is a strong indicator of hidden account-authentication functionality embedded in an unrelated skill, enabling abuse of the platform for unsolicited SMS sending, account workflows, or covert user verification flows.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code directly invokes an authentication-related endpoint to send SMS codes and exposes the resulting session token to the caller. In the context of a map-development helper skill, this unjustified auth capability creates a dangerous primitive that could be used for unauthorized account operations, SMS abuse, or social-engineering support, and the contextual mismatch makes the behavior more suspicious rather than less.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This script’s documented purpose is to create or reuse Tencent Map API keys, which extends beyond a passive documentation or code-review skill into credentialed account/resource management. In the context of a map-development guidance skill, embedding key lifecycle operations increases the chance of unauthorized provisioning or misuse of platform resources if the script is invoked with a valid token.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code performs authenticated remote key-management operations against Tencent’s supplement API using a provided supplement token, enabling creation or reuse of API keys. Because this capability is embedded in a skill whose stated purpose is development assistance for JSAPI GL, it introduces a high-risk privileged action that could be abused to provision credentials, expand access, or consume quota without clear necessity or user safeguards.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill expands from a Tencent Map JSAPI GL development guide into an operational workflow for collecting phone numbers, handling SMS verification, provisioning service keys, and persisting them locally. That is a material scope expansion involving sensitive data and credential handling, which increases the chance of unauthorized collection, misuse, or user surprise if the agent executes it automatically.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The guide directs the agent to write phone-linked key material into a predictable local config file without clearly documenting this storage behavior in the skill metadata. Local persistence of identifiers and API credentials creates confidentiality and privacy risks, especially on shared machines or where file permissions are weak.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This section embeds a full phone verification and SMS code workflow that is not necessary for a normal JSAPI GL coding-assistance skill. Because it instructs the agent to solicit a real phone number, process one-time codes, and manage session tokens, it turns a documentation skill into an identity-linked onboarding flow with elevated privacy and abuse potential.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill directs users through creating and managing WebService API keys and quota allocations, which is broader than the declared JSAPI GL guidance role. This mismatch matters because key management is a credential-administration activity with real security consequences if invoked unexpectedly or without clear authorization.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The auto-trigger condition is broad enough to activate on many Tencent-map-related mentions, increasing the chance the skill runs outside the user's intent. In a skill that also references key discovery and local file usage, overbroad triggering raises the risk of unnecessary secret access, unintended network actions, or confusing context takeover.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document shows concrete examples of session tokens, supplement tokens, and full key values without warning that these are secrets that should not be logged, screenshotted, pasted into chats, or rendered in plaintext UIs. In an agent-assisted environment, example formats are often copied directly into implementations and debugging output, increasing the chance of accidental credential disclosure and subsequent unauthorized use.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The SMS code flow requires collecting and transmitting a personal phone number, but the documentation does not warn implementers that this is personal data requiring user notice, minimization, and appropriate handling. In a skill that may be used to generate implementations, this omission can lead to privacy-noncompliant collection flows, unnecessary retention, or accidental exposure of phone numbers in logs and debugging traces.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The page sends either the visitor's IP address or a user-entered IP to Tencent's geolocation service without any clear disclosure, consent prompt, or privacy notice. IP addresses are personal data in many jurisdictions, and silent transmission to a third party can create privacy, compliance, and user-trust risks even if the functionality is expected in a demo.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The call to locate() on page load triggers IP-based geolocation immediately, causing the requester's IP to be sent to the mapping service without prior notice or consent. This increases privacy risk because collection happens automatically before the user can understand or control the data flow.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The code sends a user-provided street address to Tencent's external geocoding service without any notice, consent prompt, or privacy disclosure. Address data can be sensitive personal information, so silent transmission to a third party creates a privacy risk and may violate user expectations or compliance requirements.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This section documents geocoding and reverse-geocoding features that process precise location data and nearby POIs, but it provides no user-facing privacy guidance, consent expectations, or data-minimization warnings. In an agent skill, that omission can encourage downstream implementations to collect or resolve sensitive location information without adequate notice or controls.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The IP geolocation capability is described as a convenient way to infer a user's city, but the documentation omits any warning that IP-based location inference is privacy-relevant and may occur without the user's awareness. That increases the risk that developers embed passive geolocation behavior into applications without transparency, consent, or appropriate limitations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The page loads executable JavaScript directly from a third-party remote origin, including a map API with an embedded key, without integrity pinning, local vendoring, or any disclosure. If the upstream CDN, account, or network path is compromised, arbitrary script can execute in the page context and access map data, DOM content, and any tokens or user interactions available to the page.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: These additional remote script resources are executed at runtime and appear to supply application data, but because they are loaded as scripts rather than fetched as passive data, they can run arbitrary code. A compromise of those endpoints would give an attacker the same privileges as first-party code and is especially risky in a demo/skill context where consumers may reuse the pattern without scrutiny.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script stores phone numbers and API keys in plaintext under the user's home directory without file-permission hardening, encryption, minimization, or user consent messaging. If the local account, backups, logs, or filesystem are exposed, these sensitive identifiers and credentials can be recovered and abused, potentially enabling unauthorized API use and privacy exposure.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script transmits a sensitive supplement token to a remote endpoint without any user-facing disclosure, confirmation, or handling guidance, which can lead to inadvertent exposure or misuse of privileged credentials. Even though HTTPS is used, the security concern is the silent use of a high-value token in a skill context where users may not expect credential transmission for administrative actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow collects a phone number and API key, then stores them locally, but does not clearly warn the user that these values will be persisted on disk. That omission undermines informed consent and can expose sensitive identifiers and credentials to other local users, backups, or malware.

Static analysis

No suspicious patterns detected.