T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:18- Finding
Excessive Tool Permissions Beyond the Skill's Mapping Purpose
- Content
View full analysis
- Remediation
View remediation
Security audit
高德地图JSAPI免费版
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a map-development guide, but it asks for broad command, file, write, and browser authority without tight limits, so users should review it before installing.
Install only if you are comfortable granting the agent broad local and browser capabilities for this skill. Prefer a revised version that limits activation to AMap JSAPI work, removes generic webhook/system/file/command claims, and restricts any file writes, commands, and network access to explicit user-approved map-development tasks.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill’s documented scope expands from a narrowly described AMap JSAPI helper into broad automation features such as file processing, API integration, information retrieval, and system command execution. This creates a capability mismatch that can cause an agent to invoke the skill for unrelated high-risk tasks, increasing the chance of arbitrary local actions or sensitive data handling under an innocuous map-tool label.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description states '支持中文交互' as a default capability, and the document does not offer an explicit language or locale choice for users. This can violate language/locale policy when a skill appears to force a specific language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger condition '需要API集成、接口对接、Webhook配置、系统连接时使用' is so broad that it can match many unrelated integration tasks. In the presence of exec/read/write/browser capabilities, this overbroad routing increases the likelihood that the skill is invoked outside its intended map-specific context, exposing unnecessary powerful tools to arbitrary requests.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill declares command execution in an 'MD+execute' workflow even though its stated purpose is providing map-development guidance. Unnecessary exec capability increases the attack surface because an agent may create and run shell commands during ordinary use, enabling filesystem inspection, network probing, or unintended side effects if prompts are manipulated.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises generic file read/write support despite being framed as a map JSAPI assistant. This broadens the skill into a general-purpose local file manipulation tool, which can lead to unauthorized reading of workspace content or modification of project files when the agent selects the skill based on its overly broad description.
- Content
Static analysis
No suspicious patterns detected.