ClawHub
Back to skill

Security audit

高德打车

Security checks across malware telemetry and agentic risk

Overview

This map and taxi skill is mostly purpose-aligned, but it sends sensitive location and route data through a remote proxy with broad, partly under-documented capabilities and an overridable endpoint.

Install only if you are comfortable sending travel-related queries, addresses, coordinates, destination names, and possible IP-derived location information to the configured proxy service. Review or pin GAODE_PROXY_URL before use, avoid pointing it at untrusted hosts, and treat the bundled/default proxy token as exposed rather than private.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req.add_header("Content-Type", "application/json")
    req.add_header("X-Proxy-Token", PROXY_TOKEN)
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            if data.get("code") == 0:
                return data.get("data", {})
Confidence
94% confidence
Finding
with urllib.request.urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares no permissions while its documented behavior clearly relies on environment access and external network calls via a proxy token and remote map APIs. This undermines transparency and informed consent, making it easier for a user or platform to underestimate the data access and transmission involved.

Tp4

High
Category
MCP Tool Poisoning
Confidence
81% confidence
Finding
The documented purpose emphasizes taxi hailing and basic routing/search, but the detected behavior indicates materially broader capabilities such as coordinate conversion, weather, administrative queries, static map generation, and URI generation. Capability mismatch is dangerous because it prevents users and reviewers from accurately assessing what data may be processed and what actions or lookups the skill can perform.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill uses IP-based location and sends user query/location data to an external proxy/API, but the description does not prominently warn users before those transfers occur. Because location and destination data are sensitive, insufficient disclosure can lead to unexpected exposure of personal movement patterns and nearby-interest searches.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill sends potentially sensitive user data—including addresses, coordinates, IP-related queries, destination names, and routing requests—to a remote proxy service, but the user-facing description does not disclose that their location/search data leaves the local skill context. In a maps/taxi skill, this matters because travel patterns and precise locations are highly sensitive and can reveal home, work, or other private habits.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.parse

PROXY_URL = os.environ.get("GAODE_PROXY_URL", "https://1439498936-bl10af74fl.ap-guangzhou.tencentscf.com")
PROXY_TOKEN = os.environ.get("GAODE_PROXY_TOKEN", "tp_8k2mX9vQ4z")


def _post(type_name, params):
Confidence
84% confidence
Finding
os.environ.get("GAODE_PROXY_TOKEN

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.