Security audit

Gaode

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Amap/Gaode Maps API helper whose network and API-key use are disclosed and aligned with its mapping purpose.

Install only if you intend to use Amap/Gaode Web Services and are comfortable providing an `AMAP_KEY`. Treat addresses, coordinates, IP addresses, and arbitrary `call` parameters as data sent to Amap's external API.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares network and environment-variable dependent behavior (AMAP_KEY, outbound requests to restapi.amap.com) but does not explicitly scope or document permitted tools/capabilities. This weakens least-privilege controls: an agent or reviewer cannot reliably tell from the manifest what external access the skill requires, increasing the chance of overbroad execution or unsafe deployment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill name is presented only in Chinese, and the document predominantly instructs usage in Chinese without stating that users may interact in another language. This can violate a language/locale policy when a skill implicitly requires a specific language without user choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes the bundled CLI as supporting specific operations: geocoding, POI search, routing, weather, and IP location. However, the documented call <path> k=v... subcommand exposes a generic wrapper for any v3/v5 endpoint, which substantially broadens the actual behavior of the CLI beyond those enumerated functions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These lines take a user-supplied path and parameters and pass them directly to the shared HTTP client, allowing access to any endpoint under https://restapi.amap.com. That is broader than the manifest's concrete CLI claims about geocoding, POI search, routing, weather, and IP lookup, even though the broader developer-guide portion mentions Amap APIs generally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The call subcommand accepts any path and arbitrary k=v parameters, then sends them over HTTP to restapi.amap.com. While network access is part of this tool's purpose, this generic pass-through behavior can transmit user or system data to a third party without a confirmation prompt or explicit warning about disclosure scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring, usage text, and user-facing error/help messages are written entirely in Chinese, which imposes a fixed language on users. The file does not indicate that the locale is intentionally limited or provide any opt-in or alternative language behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.