全能聚合地图规划助理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:26 AM UTC
• Version: 1.0.1

Overview

This map-planning skill is mostly purpose-aligned, but it stores and shares sensitive location and behavior data with weak disclosure and weak user separation.

Install only if you are comfortable with location queries and generated map point data being sent to AMap and with local plaintext storage of travel history and preference profiles. Use an isolated, single-user environment or add authenticated user identity, restrictive file permissions, retention/deletion controls, and clear consent notices before multi-user or sensitive-location use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/index.js:16

Finding

Caller-Controlled User Identifier Enables Cross-User Data Access and Modification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/memory/index.js:49

Finding

Travel and Behavioral Profiles Are Persisted in Unprotected Plaintext Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (54)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 39)May include surrounding context.

创建 .env 文件：

bash

cp .env.example .env

编辑 .env 文件，填入你的API密钥：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/usage.js (reported line 95)May include surrounding context.

js

console.log('⚠️  请先配置AMAP_API_KEY环境变量\n');
    console.log('配置方法：');
    console.log('  export AMAP_API_KEY=你的高德API密钥\n');
    console.log('或创建 .env 文件：');
    console.log('  AMAP_API_KEY=你的高德API密钥\n');
    return;
  }

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that it does not collect privacy information, but elsewhere documents persistent memory, user profiles, travel history, and recent interaction records. This is a material inconsistency that can mislead users and operators about data handling, undermining informed consent and creating privacy/compliance risk if personal behavior data is stored without clear disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes long-term memory, user profiling, and history tracking without any clear notice, consent flow, or user control. In the context of a location/planning assistant, these features can reveal sensitive behavioral patterns such as home city, movement history, preferences, schedule habits, and budget profile, making the omission more dangerous than in a non-personalized skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The personal map creation logic uploads batches of POI names, exact coordinates, addresses, and IDs to a third-party Amap endpoint, which can expose sensitive travel patterns, residences, workplaces, or other private locations. It also produces shareable URLs/QR codes, increasing the chance of unintended disclosure if users are not explicitly informed and consent is not obtained before upload.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs users to send POI names, precise coordinates, and street addresses to a third-party mapping API, but it does not warn that this may disclose sensitive location data or require user consent and data-handling controls. In a skill context, documentation is often followed directly, so omission of privacy guidance can lead to unintended sharing of personal, customer, or operationally sensitive locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples place the API key directly in the URL query string, which can cause credential exposure through browser history, logs, analytics, proxies, referrer leakage, and shared screenshots or documentation reuse. Although the upstream API may require this parameter, the guide lacks any warning or compensating guidance on secret handling, increasing the risk of accidental key disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file contains installation and usage instructions exclusively in Chinese, including the example natural-language trigger phrase. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The feature explicitly describes batch transmission of POI/location data to a third-party mapping API and generation of shareable links/QR codes, yet it omits user-facing notice, consent, and privacy guidance. If users upload sensitive or private locations, this can lead to unintended disclosure to the external provider or to anyone who receives the generated map link or QR code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

该文档在“使用流程”中给出的用户输入示例包括“帮我生成...地图”“帮我做...地图”“开启旅行模式规划...”等自然语言短语，但没有列出明确的触发短语范围、约束条件或反例。这类表述较接近日常聊天请求，若被用作技能触发描述，容易造成何时应激活该技能的不确定性。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L009-L067 将地图生成、长记忆、用户画像、活动管理、路线规划、天气路况联动等全部标记为“✅”已实现。可是在 L166-L172，记忆系统持久化、用户画像更新、活动数据刷新、路线规划算法以及完整API流程都被列为待测试，说明这些能力至少尚未验证到足以支持“完成”印象的程度。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes long-term memory and user profiling capabilities without any privacy notice, retention disclosure, consent flow, or reset defaults beyond a brief mention of tag reset. In a location-based assistant, persistent storage of user preferences, cities, and activity patterns can reveal sensitive behavioral data and create privacy and compliance risk if users are unaware or cannot meaningfully opt out.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document lists external map, weather, and traffic API calls but does not warn that user queries, addresses, coordinates, and travel intent may be sent to third-party services. Because this is an LBS skill handling potentially sensitive location information, lack of transparency about third-party transmission increases privacy risk and may violate user expectations or policy requirements.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L232-L243 明确宣称八大核心功能均“已实现并可正常运行”。但 L166-L172 同时列出完整API调用流程、记忆系统持久化、用户画像更新、活动数据刷新、路线规划算法均为“待测试功能”，且 L168-L172 涉及该总结中宣称已完成的核心能力，因此文档对运行成熟度的表述与文件内其他说明相矛盾。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide advertises profile, history, favorites, and resident-city features, and elsewhere states the system will learn user preferences over time, but it does not disclose that personal preference and travel-history data may be stored and used for personalization. This creates a privacy-transparency issue: users may reveal sensitive location habits and interests without informed consent or retention expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says outputs include Gaode personal map links and QR codes for one-click navigation, but it does not warn that itinerary, destination, and possibly user location data may be transmitted to an external mapping provider. Users could unknowingly share sensitive travel plans or location context with a third party, creating privacy and data-sharing risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented long-term memory, automatic profiling, and nightly behavioral review imply continuous retention and analysis of user interaction data, but the README does not clearly warn users that these features persistently store and process their usage patterns. In an assistant centered on travel habits, routines, and preferences, this can reveal sensitive lifestyle information and creates a meaningful transparency and consent problem.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that the skill does not collect privacy information, yet earlier sections describe persistent memory, user profiling, behavior review, and activity recommendations based on user preferences. Even if the stored data is limited to preferences and history rather than formal identifiers, it is still user-related behavioral data, so the documentation is misleading and may cause users to consent without understanding ongoing collection and analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JavaScript example file uses Chinese exclusively in the title, comments, console output, and example user prompts, which indicates a fixed language experience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

全文标题、触发词、指令示例、输出格式和功能说明均默认并强制使用中文，没有说明是否支持其他语言，也未给出用户可选择语言的机制。若组织政策要求不应在未获用户同意时强制特定语言/locale，这种单一语言默认属于自然语言策略风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

该技能将“夜市/早市/烟火/市井”“用户画像/历史游历/本地活动”“人文讲解/历史典故”等常见词直接作为触发关键词，但未说明需要与地图规划场景组合使用，也没有提供排除条件或负例。像“烟火”“本地活动”“历史典故”这类表述在普通对话中也很常见，容易造成非目标场景下的意外激活。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code persists activity data to activity.json, which affects local user/system data, but the only disclosure is an internal code comment. There is no confirmation prompt or user-visible notice at the write point indicating that fetched or custom activity data will be stored on disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code comments and function name indicate fetching activity data from an API, but the implementation queries POIs by keyword and then fabricates event fields such as dates and times in convertPoiToActivity. This is an intent-level mismatch because the returned objects are not actual sourced event records, but inferred activities built from place search results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module sends the provided city value to an external AMap search API via amap.searchPoisByKeyword(...). Although network access is core to the feature, this file contains no user-facing warning, log, or documentation that user-provided location context will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

When a user adds a custom activity, the supplied details are persisted locally through saveActivities(...). This modifies stored data and may include user-entered content, but the code provides no user-visible disclosure that the information will be saved.

Content

No source excerpt is available for this finding.