Security checks for vulnerabilities and agentic risk
Overview
This appears to be a straightforward AMap mapping helper, with the main caution that it sends location queries and the AMap API key to AMap and can create a temporary map image.
Install only if you are comfortable sending map searches, addresses, coordinates, route endpoints, and your AMap API key to AMap. Treat the Guangzhou transit default and Chinese-only interface as scope limitations, and install Pillow from a pinned or trusted dependency source rather than following an unconstrained pip install prompt.
When Pillow is unavailable, the program directs the user to install Pillow without specifying a reviewed version, an integrity hash, or a locked dependency manifest. The command therefore resolves whichever package release the configured Python package index currently serves.
Although the application does not automatically execute the installation command, following its explicit guidance can expose users to mutable upstream releases, compromised package-index accounts, malicious package mirrors, or unexpected changes in newer dependency versions. Python package installation can run build and installation logic with the privileges of the user invoking pip.
The use of Pillow is legitimate and necessary for the declared static-map image-generation functionality. The risk arises from the insecure installation guidance rather than from an unnecessary privilege request or confirmed malicious behavior in Pillow.
Attack Path
A user invokes static_map.py on a system where Pillow is unavailable.
The script displays the instruction pip install Pillow.
The user runs that command without a version constraint or integrity verification.
The configured package index or mirror supplies a compromised, substituted, or otherwise unsafe release.
Package build or installation logic executes under the account running pip.
Malicious logic can access resources available to that account and can subsequently affect execution of the static-map component.
This path depends on compromise or manipulation of the dependency distribution cha
...[truncated 605 chars]
Remediation
View remediation
Remediation Suggestions
Declare Pillow in a committed dependency manifest rather than instructing users to install an unconstrained latest version.
Pin Pillow to an exact, reviewed version, for example:
text
Pillow==<reviewed-version>
Record verified distribution hashes and require hash validation:
text
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content
Scanner excerpt · static_map.py (reported line 130)May include surrounding context.
python
map_url = f"{STATIC_MAP_URL}?{query_string}&key={API_KEY}"
try:
with urllib.request.urlopen(map_url, timeout=15) as response:
img_data = response.read()
if img_data[:8] == b'\x89PNG\r\n\x1a\n' or img_data[:2] == b'\xff\xd8':
return Image.open(io.BytesIO(img_data))
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented behavior does not fully match the declared purpose: it mentions route planning and POI search, but also includes static map download, local file creation, automatic sending, and cleanup. Behavior mismatches are risky because reviewers and users may authorize a skill for one purpose while it performs additional data handling or output actions not clearly disclosed.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents use of environment variables and outbound API calls, but it does not declare any tool scope such as permissions or allowed-tools. This weakens enforcement and reviewability because the runtime capabilities needed to access secrets and contact external services are implicit rather than explicitly constrained.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
This skill processes addresses and precise coordinates and sends them to an external map provider, but the description does not warn users about that privacy-sensitive transmission. Location data can reveal home, work, routines, or other sensitive personal information, so undisclosed sharing increases privacy and compliance risk.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill description and all user-facing strings are in Chinese, and the transit request is additionally fixed to the city '广州', which imposes a specific locale/region assumption. The file does not offer a language or locale option, nor does it clearly justify that this is a region-specific tool.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The skill transmits user-supplied addresses, coordinates, route endpoints, and search terms to the external AMap API, which can expose sensitive location and behavioral data to a third party. In this skill context, that data is central to functionality, but the code provides no user-facing disclosure, consent flow, or minimization controls, increasing privacy risk rather than indicating overtly malicious behavior.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The transit API call always uses city='广州', which forces a specific regional context regardless of the user's actual location or intent. Because the code does not expose this as a user choice or clearly document the restriction, it violates the language/locale policy criteria.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
This code includes natural-language descriptions and CLI/help/error output in Chinese only, starting with the module docstring and continuing throughout the script. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
86% confidence
Finding
The skill description and all user-facing instructions are written in Chinese, including the '直接跟我说' interaction guidance, with no indication that other languages are supported or that Chinese is required for a justified regional reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content
No source excerpt is available for this finding.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
87% confidence
Finding
The static map feature states that it automatically generates a map, sends it, and cleans up temporary files, but this side effect is not presented as a warning or operational caveat. Undisclosed file creation and automatic output transmission can expose location-derived content unexpectedly and complicate auditing of where user data was stored or sent.
