Security audit

tmap-lbs-skill

Security checks for vulnerabilities and agentic risk

Overview

This Tencent Maps skill is useful and purpose-aligned, but it needs review because it installs an unpinned global CLI and tells agents to run user-influenced shell commands with a map API key.

Install only if you are comfortable using Tencent Maps services with your location and itinerary data. Use a restricted Tencent Maps API key, avoid pasting secrets into chat, prefer an isolated/local pinned install of the CLI, and be cautious with requests containing shell metacharacters or untrusted trail-data URLs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: references/scene1-nearby-search.md:38
Finding: Shell Command Injection Through Unquoted User-Controlled Arguments
Content: View full analysis
[options] tmap-lbs route --mode \ --origin \ --destination [options] tmap-lbs travel --city \ --interests [options] tmap-lbs trail --data ``` For example, the trajectory workflow directly places a URL extracted from a user message into a shell command: ```bash tmap-lbs trail --data https://mapapi.qq.com/web/claw/trail.json ``` The nearby-search workflow similarly directs the Agent to insert a parsed location and search category directly into command arguments: ```bash tmap-lbs nearby --location {location} --keywords {search-category} ``` ### Technical Analysis The documented workflows instruct the Agent to extract values such as locations, search keywords, cities, interests, coordinates, and URLs from user input and interpolate them into Bash commands. The instructions do not require: - Shell-safe argument-array execution. - Quoting or escaping of interpolated values. - Rejection of shell metacharacters. - Numeric validation of coordinates and radii. - Enumeration ...[truncated 2533 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Globally Installed Third-Party Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are overly broad, including generic terms like "搜", "找", "查", "附近", and "规划" that commonly appear in ordinary conversation. This can cause the agent to invoke the map skill in unintended contexts, leading to incorrect tool use, unnecessary API calls, and possible disclosure of user location-related queries to an external service when the user did not clearly request it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s operational instructions and reply templates are entirely in Chinese and direct the agent to follow them strictly, which implies a fixed language/locale behavior. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The note at L06 says to '不要生成代码或者调取其他脚本或者接口' (do not generate code or invoke other scripts or interfaces). However, the document subsequently instructs invoking tmap-lbs commands, using API-based search and geocode operations, and even previewing the generated webpage at L89. This is an active contradiction between the guidance and the described behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to provide and configure a Tencent Maps API Key but does not warn that the key is a sensitive credential or advise secure handling practices. In an agent context, this can lead users to paste secrets directly into chat or store them insecurely, increasing the risk of credential leakage, misuse, and unexpected billing or quota exhaustion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to generate and return a Tencent Maps travel-planning URL that embeds the user's selected destinations and itinerary data, but it does not warn that this information will be transmitted to a third-party service when the link is opened or previewed. Because the template even says to directly preview the webpage, users may unknowingly disclose sensitive travel interests, locations, or plans without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are broad natural-language keywords like “轨迹” and “运动轨迹,” which can overlap with ordinary user requests and cause the skill to activate when the user did not clearly intend to use this map function. In a tool-using agent, such over-triggering can route user input into unintended command generation or external-link handling, increasing the chance of incorrect actions or data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L26-L29 给出的固定回复模板全部为中文，且文件整体未说明这是仅面向中文用户的地区性技能，也未给出根据用户语言偏好切换的选项。这会构成语言/locale 约束未获用户选择的自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 整个技能文档从标题、说明到触发示例均仅以中文呈现，且未说明是否支持其他语言，也未给用户提供语言或区域选择。根据规则，未提供用户选择或合理地域性说明的语言限定属于自然语言策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The entire skill specification, prompts, examples, and reply template assume Chinese-language interaction and do not indicate that this is a China-only or Chinese-only skill. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.