test-hello-world

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:14 PM UTC
• Version: 1.0.0

Overview

This skill only generates Amap search links from location names, with no code execution, file access, credentials, persistence, or hidden behavior.

Before installing, understand that this skill may answer broad location questions with an Amap search link instead of giving directions or factual context. Users should check generated links when place names contain unusual characters, and the publisher should prefer percent-encoding the query value.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:22
• Finding: Unencoded User-Controlled Input in Generated Search URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 22–26 **Vulnerability Type**: Improper URL encoding of user-controlled input **Risk Level**: Low ### Complete Code Snippet ```text **URL format:** https://ditu.amap.com/search?query={keyword} ``` The skill also explicitly instructs the agent to place the keyword into the URL without manually encoding it. ### Technical Analysis The skill extracts a location keyword from user input and directly interpolates it into the `query` parameter of an Amap URL. It relies on the browser to handle encoding rather than requiring the value to be percent-encoded before URL construction. User-controlled values may contain reserved URL characters such as `&`, `#`, `?`, `%`, or whitespace. Direct interpolation can therefore change the interpretation of the generated URL. For example, an ampersand may terminate the intended `query` value and introduce another query parameter, while a hash character may move the remaining content into a URL fragment. The issue is limited to generated text and links. The reviewed skill contains no executable scripts, API credentials, dependency installation, file operations, or system commands. ### Attack Path 1. An attacker supplies a location string containing URL metacharacters, such as `Example&unexpected=value`. 2. The skill removes recognized search-related modifiers but performs no required URL encoding or control-character validation. 3. The remaining attacker-controlled value is inserted directly after `query=`. 4. The generated URL becomes structurally different from the intended single-parameter search URL. 5. A recipient may receive or follow a malformed or misleading link containing unintended parameters or fragments. This path does not provide code execution, system access, elevated privileges, or access to private data based on the audited content. ### Impact Assessment The potential impact is confined to URL integrity and response presentation. An a ...[truncated 355 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Percent-encode the extracted keyword as a UTF-8 query-parameter value before inserting it into the URL. 2. Use a URL-construction routine that treats the keyword strictly as the value of the `query` parameter rather than concatenating raw text. 3. Reject or remove carriage returns, line feeds, and other control characters before rendering the response. 4. Preserve legitimate Unicode place names while encoding reserved characters. 5. Replace the instruction that browser-side encoding is sufficient with an explicit requirement for parameter encoding. 6. Add tests for keywords containing ampersands, hash characters, question marks, percent signs, spaces, quotation marks, and line breaks. 7. Verify that the final URL retains the fixed HTTPS scheme, the exact `ditu.amap.com` host, the `/search` path, and only the intended encoded query value. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger conditions are broad enough to activate on many ordinary location-related utterances, not just explicit requests to generate an Amap search link. This can cause the skill to intercept unrelated queries and respond with a link when the user may have intended navigation advice, factual answers, or a different tool, leading to incorrect routing and reduced safety/control of agent behavior.

Static analysis

No suspicious patterns detected.