T09 · Insecure Skill Coding Practices
Warning
- Location
CLAUDE.md:27- Finding
API Keys Are Exposed by the Recommended Configuration Check
- Content
View full analysis
- Remediation
View remediation
Security audit
map-query
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent map-search tool, but it unnecessarily exposes configured map API keys and can send duplicate location-bearing requests because of script entry-point side effects.
Review before installing. Use only restricted, low-quota map API keys, avoid printing or pasting key values into chats or logs, and rotate any key already exposed. Be aware that addresses and coordinates are sent to AMap, Baidu, or Tencent, and that the current scripts may make duplicate requests until their CLI entry points are guarded.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geocode.mjs:89- Finding
Unconditional Module Entry Points Cause Duplicate Location and Credential-Bearing Requests
- Content
View full analysis
[--provider ]'); console.error('\nExample:'); console.error(' node geocode.mjs "北京市朝阳区三里屯"'); console.error(' node geocode.mjs "北京市朝阳区三里屯" --provider amap'); process.exit(1); } let address = ''; let provider = null; for (let i = 0; i < args.length; i++) { if (args[i] === '--provider' && args[i + 1]) { provider = args[i + 1]; i++; } else { address += (address ? ' ' : '') + args[i]; } } try { const result = await geocode(address, provider); console.log(JSON.stringify(result, null, 2)); } catch (error) { console.error('Error:', error.message); process.exit(1); } } main(); ``` `scripts/search.mjs` imports that module and also invokes its own CLI entry point unconditionally: ```js import { CONFIG, getFirstEnabledProvider } from '../config.js'; import { geocode } from './geocode.mjs'; // ... async function main() { // CLI parsing and search execution } // Invoked even when this file is imported as a library. main(); ``` `scripts/food.mjs` imports `search.mjs`, triggering both dependency entry points during module loading: ```js import { search } from './search.mjs'; // ... async function main() { // CLI parsing and food search execution } main(); ``` `scripts/promotion.mjs` similarly imports `geocode.mjs`: ```js import { CONFIG, getFirstEnabledProvider } from '../c ...[truncated 3244 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rmdir /S /Q %USERPROFILE%.openclaw\skills\map-query
Linux/Mac
rm -rf ~/.openclaw/skills/map-query
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rmdir /S /Q %USERPROFILE%.openclaw\skills\map-query
Linux/Mac
rm -rf ~/.openclaw/skills/map-query
text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/search.mjs "Sanlitun, Chaoyang District, Beijing" --type food
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/search.mjs "Sanlitun, Chaoyang District, Beijing" --type food
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs users to print secret-bearing environment variables with
echo $AMAP_KEY,echo $BAIDU_MAP_KEY, andecho $TENCENT_MAP_KEY. This can expose API keys in terminal history, logs, chat transcripts, screenshots, or agent tool output, creating a credential disclosure risk even though the stated goal is only to check whether keys are configured.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file presents a location-based skill for Chinese places and addresses, but all expected outputs are fixed in English and there is no indication that users may choose their preferred language or locale. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### AMap (Recommended) 1. Visit https://lbs.amap.com/ 2. Register/Login account 3. Go to Console → App Management → Create New App 4. Add Key, select "Web Service" type 5. Copy your API Key
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The instructions explicitly recommend loading the API key from ~/.bashrc, which creates persistent credential availability in every future shell session. This broadens exposure and makes accidental disclosure more likely through shell history, dotfile syncing, debugging output, or compromised local user contexts.
- Content
export BAIDU_MAP_KEY="your_baidu_map_key" export TENCENT_MAP_KEY="your_tencent_map_key"
Permanent setting (add to ~/.bashrc or ~/.zshrc)
echo 'export AMAP_KEY="your_amap_api_key"' >> ~/.bashrc source ~/.bashrc
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The installation guide tells users to persist API keys in shell startup files such as ~/.bashrc without any warning about credential exposure. Startup files are long-lived, frequently backed up or copied between systems, and may be readable by other local processes or accidentally committed or shared, increasing the chance of secret leakage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly accepts user-provided addresses and uses third-party map providers for geocoding and nearby search, but it does not disclose that those addresses will be transmitted to external services. Addresses can contain precise location or other sensitive personal information, so failing to warn users creates a privacy and consent issue rather than a purely technical bug.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script takes a user-supplied address and forwards it to the imported search function, which likely queries an external map/search provider selected by the user. Because addresses can contain precise location or personal data, sending them off-device without any disclosure or consent creates a privacy risk, especially in a CLI/tooling context where users may not realize a third party receives the query.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends the user-supplied address to third-party geocoding providers over the network, but this file provides no disclosure, consent prompt, or warning that potentially sensitive location information will leave the local environment. Addresses can contain home, workplace, or other private location data, so silent transmission creates a real privacy risk even if it is expected for geocoding functionality.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The search keywords are fixed to Chinese terms, and the CLI example later also assumes a Chinese-language address format. This imposes a specific language/locale behavior without offering user choice or documenting a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Baidu query string is fixed to Chinese-language search terms, which constrains the tool to a specific language/locale. There is no user opt-in, configurable locale selection, or explicit justification in this file for this restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Tencent query uses Chinese-only keywords, forcing a locale-specific search behavior. The file does not provide a mechanism for user language choice or explain that the script is limited to a particular region or language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script takes a user-supplied address, geocodes it, and sends the resulting location data to third-party map providers without any disclosure, consent prompt, or minimization visible in this file. Because addresses often reveal sensitive location information such as home or workplace, this creates a real privacy risk through external data sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This CLI sends user-supplied addresses or derived coordinates to third-party map providers for geocoding and nearby-place search, but this file does not present any explicit user-facing privacy notice or confirmation before transmission. Location and address data are sensitive, and silent disclosure to external services can create privacy and compliance risks, especially when users may assume processing is local.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This is a markdown file, so SQP-2 applies to missing user-facing warnings in the skill description or examples. The examples prominently use full or near-full location inputs and geocoding outputs, but the file does not include any warning that the skill processes location data, which can affect user privacy.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README uses "Help me find what's good to eat near ..." as a user invocation example. The leading phrase "Help me find" is very generic everyday language and, without any stated trigger constraints or exclusions, could contribute to overly broad activation guidance for the skill.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code reads API credential environment variables for multiple map providers, but the file contains no comments, logging, or other user-facing disclosure indicating that provider keys will be accessed from the environment. For a code file, credential access can warrant a warning unless the behavior is documented elsewhere or clearly disclosed in the file itself, and no such disclosure is visible here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file uses fixed Chinese strings such as '美食', '川菜', '粤菜', and a Chinese example address, which creates a locale-specific behavior without any opt-in or documented justification. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The script uses provider API keys from configuration/environment-backed settings to call third-party services. Although this is operationally expected for geocoding, the file provides no inline warning or documentation that external credentials are required and will be used for outbound requests.
- Content