ClawHub
Back to skill

Security audit

高德地图全能版

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed map utility that sends user map queries to a remote proxy, with privacy sensitivity users should understand before use.

Use this only if you are comfortable sending addresses, coordinates, route origins/destinations, POI searches, weather locations, and optional IP-location queries through the skill publisher's remote proxy. Avoid using it for sensitive home, work, or private travel details unless you trust that proxy and its stated no-storage claim.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises external networked functionality and likely relies on environment-backed or proxy-backed capabilities, but it does not declare corresponding permissions. This creates a transparency and governance gap: users and platform reviewers cannot accurately assess what external access the skill needs, and undeclared network use can hide data egress paths.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill supports IP-based geolocation and states that user query parameters are sent to a Gaode proxy/API, but it does not clearly warn users that location-related and search data may be transmitted to third parties. Because location, addresses, routes, and nearby-search queries can reveal sensitive movement or residence information, the lack of explicit privacy notice and consent increases privacy risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill transmits user-supplied addresses, coordinates, POI queries, routes, weather locations, and IP-related inputs to a hard-coded remote proxy service without any in-code disclosure or consent mechanism. In a map skill, this data is often highly sensitive because it can reveal home/work locations, travel plans, and precise movement patterns.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill forwards sensitive user-supplied inputs such as addresses, coordinates, route origins/destinations, and possibly IP addresses to a remote proxy service controlled outside the local skill. In a map skill, this context increases sensitivity because travel patterns and precise locations can reveal home/work addresses and movement habits, yet the code contains no consent, minimization, or disclosure mechanism.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.