Security audit

baidu-map-jsapi-three

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only MapV-Three GIS skill with some security-relevant coding caveats but no hidden execution, exfiltration, or persistence behavior in the artifacts inspected.

Before installing, treat this as Chinese-language developer documentation for MapV-Three. When using its examples, avoid embedding real API keys or bearer tokens in frontend code, sanitize any HTML or feature data rendered into popups/DOM overlays, and add confirmation/authorization around map edit or delete operations that affect backend data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (46)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
- `reference/measure.md` - Measure 测量工具

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains the skill's user-facing description and guide entirely in Chinese, which effectively forces a specific language for users. The policy allows fixed locale only when the skill offers language choice or clearly justifies the constraint, neither of which is present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents HDMapEdit as supporting element editing, addition, deletion, and updates via backend services, but it does not include any caution that these actions can modify persistent map data. For markdown files, safety-affecting behaviors that could impact user data or system integrity should be disclosed explicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing instructions and examples exclusively in Chinese, and does not indicate that the skill is intentionally region-specific or provide any opt-in language selection. That can violate language/locale policy where skills must not force a specific language without user choice or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The title and all instructional content are written exclusively in Chinese, which constitutes a language/locale constraint in the skill’s natural-language documentation. The file does not offer an alternative language option or explain that the skill is region-specific, so it may violate a language-choice policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes fromURL() for loading JSON from a URL and later shows examples calling external HTTPS endpoints, including an Authorization header. Although the examples are instructional, the document does not include any warning that using remote URLs may transmit user or system data to third parties or expose sensitive tokens if misused.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference/datasource/json-datasource.md (reported line 129)May include surrounding context.
md
}); // 加载 API 数据 const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/points', { parseCoordinates: (item) => ({ type: 'Point', coordinates: [item.location.longitude, item.location.latitude]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference/datasource/json-datasource.md (reported line 169)May include surrounding context.
md
}); // 加载 API 数据 const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/points', { parseCoordinates: (item) => ({ type: 'Point', coordinates: [item.location.longitude, item.location.latitude]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · reference/datasource/json-datasource.md (reported line 427)May include surrounding context.
md
}); // 加载 API 数据 const data = await mapvthree.JSONDataSource.fromURL('https://api.example.com/points', { parseCoordinates: (item) => ({ type: 'Point', coordinates: [item.location.longitude, item.location.latitude]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example shows an Authorization: 'Bearer token' header inline without any warning that secrets must not be hard-coded in client-side code or documentation examples copied into production. This can normalize insecure credential handling and lead developers to embed real API tokens in browser-delivered code, exposing them to users, logs, or source control.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all user-facing instructions and examples only in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language option is provided. The file does not indicate that the skill is intentionally region-specific or that users may choose another language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents operations that delete all features, delete by type, and delete by ID, but it provides no warning that these actions remove user data or may be irreversible. Under the markdown-specific missing-warning rule, destructive behavior affecting user data should be disclosed to users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The title and all instructional content are presented in Chinese, with no indication that other languages are supported or that the user can choose their preferred locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions exclusively in Chinese, including headings, comments, and explanatory text. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's headings, descriptions, examples, and output strings are entirely in Chinese, including user-facing labels like measurement units and event logs. The policy allows locale constraints only when users are given a choice or when the constraint is explicitly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all operational instructions and usage details in Chinese, with no indication that users can choose another language or locale. That can violate a language/locale policy requiring user choice rather than forcing a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all user-facing instructions and examples exclusively in Chinese. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The title setter examples demonstrate passing arbitrary HTML strings, which encourages direct injection into a rendered DOM context. If developers bind unsanitized dataset values or user-controlled labels into popup titles, this can execute attacker-controlled script or markup in the browser.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly shows assigning raw HTML strings to popup.content and using innerHTML to build interactive DOM without any warning about sanitization or trusted input. In a web UI component, this can lead developers to render untrusted user data directly, creating DOM-based or stored XSS if popup content originates from external data, map features, or user input.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation content is written entirely in Chinese, starting with the title and continuing through all usage instructions, without indicating any optional language support or region-specific requirement. This can violate language/locale policy when users are not given a language choice or an explicit justification for the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file's title, descriptions, parameter explanations, and usage notes are written entirely in Chinese, which imposes a specific language on users. Under the policy, language restrictions should be optional or explicitly justified as region-specific, neither of which is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file forces a specific language/locale for all instructions and examples, and there is no indication that users can opt into another language. Under the stated policy, language-only documentation is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation includes a WebSocket example that receives and processes live vehicle track data, which is privacy-sensitive operational data. The surrounding markdown does not provide any warning or disclosure about network transmission, handling of real-time location data, or the need to secure the connection and data source.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.