ClawHub
Back to skill

Security audit

oo

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent Amap mapping helper, but it includes an unsafe shell command pattern for user-provided locations and weak API-key storage.

Review before installing. Use AMAP_WEBSERVICE_KEY from your environment or a managed secret store instead of saving config.json when possible. Do not let an agent run the documented curl command with raw user-provided locations; use the JavaScript axios path or URL-encode parameters through a structured HTTP client. Only provide public, non-sensitive heatmap data URLs, and pin/audit axios before use in a sensitive workspace.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:143
Finding

Shell Command Injection Through User-Controlled Geocoding Input

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:24
Finding

Amap API Key Stored in an Insufficiently Protected Plaintext Configuration File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

整体上，这段代码确实属于高德地图相关服务，且实现了 POI 搜索与多种路径规划，也包含一定的旅游规划逻辑，因此声明的大方向基本一致。但存在几个实质性落差：1) 没有看到高德“周边搜索”对应的接口调用，searchPOI 使用的是 v5/place/text 文本搜索，并非周边搜索；2) 没有热力图可视化实现，generateMapLink 只是拼接一个静态页面链接，没有热力图数据组织、渲染或相关 API；3) travelPlanner 内部构造了 mapTaskData，但最终并未返回可视化链接或地图任务数据，与其注释和声明中的“旅游规划/可视化”能力不完全匹配。此外，代码还具备本地读写 config.json 保存 API Key 的能力，虽属支持性实现，不构成主要用途偏离。综合判断，声明对能力有明显夸大，属于描述与行为不完全一致的情况。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该代码块的实际功能聚焦于路径规划，是声明中的一个子集：支持步行、驾车、骑行和公交路线规划，并生成路线地图链接。未发现额外的未声明高风险能力。但声明描述的是“综合服务”，包括POI搜索、旅游规划、周边搜索和热力图可视化，而此代码块没有体现这些能力，因此描述与该代码块实际行为不一致，存在明显的过度声明/范围不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

从给出的代码片段看，其实际作用较窄，主要是一个 CLI 入口，用于根据城市、兴趣点和路线类型调用 travelPlanner 执行旅游规划。它确实与“旅游规划”相关，也可能间接涉及 POI 和路线数据，但代码中没有看到声明所述的“高德地图综合服务”范围内的多个能力实现或入口，尤其未体现周边搜索、热力图数据可视化，以及独立的 POI 搜索/综合地图服务能力。由于声明描述的是多功能综合服务，而代码片段仅展示单一旅游规划脚本，描述相对夸大，存在明显不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares access to a sensitive environment secret (AMAP_WEBSERVICE_KEY) but does not define explicit tool scope boundaries such as allowed tools or permissions. In practice this increases the chance that a host agent could invoke broader capabilities than intended, especially since the skill also instructs use of shell commands and local configuration storage for the key.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation description lacks clear limits for when the skill should not run, making accidental invocation more likely. In this skill's context that matters because it handles API keys, user locations, and external URLs, so an unnecessary activation can collect or transmit data that was not meant for a mapping workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger keywords are extremely broad (搜, 找, 查, 附近, 规划), which can cause the skill to activate on many unrelated user requests. Over-broad activation can redirect sensitive or unrelated queries into a skill that requests API keys, generates external links, or processes location data, increasing the chance of unintended data exposure or unsafe workflow execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heatmap feature sends a user-provided dataUrl to an Amap-hosted page without prominently warning that the external site will fetch and potentially log that URL. If users supply private, signed, internal, or preauthenticated links, this can leak sensitive datasets or access tokens to a third party and create SSRF-like access from the external page's infrastructure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JavaScript file uses Chinese for comments, prompts, status logs, and error messages throughout the skill, including all user-visible console output. Because the skill provides no language selection, opt-in, or documented region-specific justification, it creates a natural-language locale policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

travelPlanner 的文档在 L284 声明返回 pois、mapTaskData、mapLink 和 htmlLink，且函数内部也确实构建了 mapTaskData。但实际在 L359-L361 仅返回 { pois: poiResults }，没有返回文档承诺的地图任务数据或链接，这属于注释/文档与代码行为的直接矛盾。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code includes natural-language instructions entirely in Chinese, and later user-facing runtime output is also Chinese-only. That enforces a specific language/locale without offering an opt-in or alternative, which matches the policy-violation category for language/locale constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code sends origin, destination, waypoints, and city data to external route-planning functions, which are network-facing operations involving potentially sensitive location information. While the script prints route results, it does not warn users that their location data will be transmitted to an external service, and no explicit disclosure appears in the file comments or usage text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s docstring, usage instructions, validation errors, and success/failure messages are all written in Chinese, with no indication that the skill is region-specific or that users can opt into another language. This creates a natural-language policy issue because it imposes a specific language/locale on all users without documented justification or choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This manifest contains natural-language text that forces a specific language for the skill description, which can violate language/locale policy when no user opt-in or justification is provided. There is no indication that the package is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json
"author": "",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.13.6"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
82% confidence
Finding

The manifest depends on axios without an exact pinned version while the package family has multiple known advisories, including SSRF-related and request-handling issues. In a map/location service skill that likely performs outbound HTTP requests to external APIs, an affected axios version could increase exposure to request manipulation, proxy bypass, or related network-originated attacks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Comments, usage instructions, error messages, and output strings are presented exclusively in Chinese, with no option for the user to select another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.