Security audit

test-tt-skill

Security checks for vulnerabilities and agentic risk

Overview

This Tencent Maps skill mostly matches its stated purpose, but it exposes API keys in user-visible links and includes unsafe command templates for user-provided locations.

Review before installing. Use only a restricted, temporary Tencent Maps key, avoid entering sensitive home/work locations or vehicle plate numbers, and do not use workflows that return key= URLs unless you accept that the key may appear in conversation history, browser history, logs, and shared links. Agents should prefer the JavaScript fetch helpers or a safe proxy and should not run the documented curl templates with untrusted user text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:120
Finding: Security Review Override Instructs the Agent to Ignore API Key Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/scene2-nearby-search.md:73
Finding: Tencent API Key Is Embedded in User-Visible Search and Travel URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/scene2-nearby-search.md:41
Finding: User-Controlled Location Values Are Interpolated into Shell Commands
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code substantially matches the core declared purpose around Tencent Maps LBS usage: it queries POIs, plans routes in several transport modes, and includes a travel-planning helper. However, the description also claims support for '轨迹数据可视化' and '地图数据可视化', which are not actually implemented here. The trip_advisor function only produces structured mapTaskData descriptors; it does not itself visualize maps or trajectories. Also, while nearby POI search is partially covered through query_place with location+radius, there is no separate specialized nearby-search capability. Because notable advertised capabilities are missing from the supplied code chunk, this is a description-behavior mismatch, though not a severe one since much of the stated mapping/search/routing functionality is present.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The drive_path function forwards plate_number to an external API, which can be sensitive personal data and may uniquely identify a user or vehicle. The skill does not provide any in-code minimization, masking, explicit consent flow, or disclosure around this transfer, increasing privacy and regulatory risk if callers pass real plate data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares use of environment variables and networked Tencent API access, but it does not define explicit tool scope or allowed-tools boundaries. That increases the risk of overbroad agent execution, because a runtime may permit more capabilities than are necessary for location lookup and route planning, especially when later reference docs instruct shell/curl usage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger conditions include very broad everyday keywords such as 搜, 找, 查, 附近, 路线, and 规划, which can cause the skill to activate for many unrelated user requests. Over-triggering is risky here because the skill may unnecessarily send user queries and location-related data to external Tencent services without clear user intent or consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill does not warn users that their search terms, addresses, coordinates, and route requests may be transmitted to external Tencent Map APIs. In a location-services context this is more sensitive than ordinary web queries, because location history and nearby-search inputs can reveal home, work, travel patterns, or other personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Natural-language strings and error/output messages are hardcoded in Chinese throughout the file, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the stated policy, forcing a specific language without user opt-in is a locale policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code sends user-supplied search, location, and routing inputs to Tencent Map HTTP endpoints, including coordinates, city names, and potentially license plate numbers in related functions. While there are progress logs, they do not disclose that potentially sensitive user/system data is being transmitted to a third-party service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该说明要求“从用户输入中识别出核心搜索词，去掉‘搜’、‘找’等修饰词”，并配有“搜美食”“找酒店”等示例，但没有给出明确的触发边界、排除条件或负例。这类基于常见日常用语的触发描述过于宽泛，容易与普通对话重叠，导致技能在不期望的场景下被调用。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs embedding the user's Tencent Maps API key directly in curl commands and returned URLs, which increases the chance the credential is exposed in chat history, browser history, logs, referrers, screenshots, or shared links. In this context, the skill explicitly asks for a temporary API key and then propagates it into user-visible artifacts without any warning or safer handling guidance, making credential leakage materially more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly asks the user to provide a temporary Tencent Maps API key and describes POI and nearby-search features that may include precise coordinates, but it does not disclose that those inputs are transmitted to Tencent's external map service. This creates a privacy and informed-consent gap: users may unknowingly send sensitive location and search-interest data to a third party, which is especially relevant for nearby search and travel-planning contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation instructs users to configure a Tencent Maps API key and submit route-planning inputs including precise origin/destination coordinates, and it also documents optional vehicle plate numbers, but it does not warn that this data is transmitted to an external third-party service. This creates a real privacy and informed-consent issue because users may unknowingly disclose sensitive location and vehicle-identifying data to Tencent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to send user-provided travel destinations and the user's Tencent Maps API key to external Tencent endpoints, but it does not clearly warn the user that their itinerary data will be shared with a third party. It also embeds the API key directly into generated URLs, which can expose the key through logs, browser history, link sharing, or referrer leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to generate a mapapi.qq.com link embedding the user-provided JSON data URL, but it does not disclose that opening the link will reveal that data location to a third party. If the supplied URL is private, signed, internal, or otherwise sensitive, this can cause unintended disclosure of data references and may trigger external fetching by the third-party service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a Tencent map/location-service skill for POI search, routing, travel planning, and visualization. In addition to those mapping functions, the code provides generic helpers to read and mutate process.env via TMAP_LBS_CONFIG, which is a capability not directly justified by the user-facing map-service purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: 整个技能文档、回复模板和示例均默认采用中文输出，且未说明是否允许根据用户语言偏好切换，也未提供用户选择语言的机制。按照语言/地区策略，若无用户明确选择或合理业务约束，默认强制单一语言属于自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: All user-facing instructions, templates, and examples are presented only in Chinese, which can amount to a language policy violation when no alternative or opt-in is provided. There is no indication that the skill is limited to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The API format and curl example on L041-L047 use location={位置} with endpoint /ws/geocoder/v1, while the complete example on L091 switches to /ws/geocoder/v1/ and uses address=西直门. These are contradictory instructions about how the geocoding request should be formed, not merely omitted detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file defines the actual generated URL as https://mapapi.qq.com/web/claw/nearby-search.html... on L073 and again in the example/template on L093 and L100, but the inline bullets then claim the domain is map.qq.com and the route is /m/place/search. This is an active documentation contradiction that could mislead an agent or developer into constructing a different URL than the one the file otherwise instructs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers language/locale policy issues. This file presents all instructions, warnings, and examples only in Chinese, with no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Natural-language policy violations apply to all file types, including markdown. The file forces a specific language presentation throughout, and there is no indication that users may opt into another language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file presents the entire skill workflow and user-facing reply templates exclusively in Chinese, with no indication that language can be selected by the user. A fixed language requirement without opt-in can violate language/locale policy when not documented as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All trigger phrases, instructions, and reply templates are fixed in Chinese, and line 5 further requires strict adherence to the provided steps. There is no indication that the skill is intentionally region-specific or that users may opt into another language, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.