Security audit

address-extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Chinese address extraction and geocoding helper, with the main caution that geocoding sends address queries to AMap when an API key is configured.

Install this if you need Chinese address parsing and optional AMap geocoding. For sensitive customer, logistics, or personal address data, use the extractor without an AMap API key unless you are comfortable sending address queries to AMap and have the necessary consent or policy approval.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes use of a network-capable geocoding API but does not declare any explicit tool scope or permission boundary. This creates a transparency and governance gap: deployments may allow outbound requests without users or reviewers clearly understanding that external network access is part of the skill’s behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill sends extracted address data to a third-party geocoding service, but the documentation does not warn about privacy, consent, retention, or third-party data sharing implications. Because addresses can be highly sensitive and may be combined with names, phone numbers, or customer records, silent transmission to an external API can expose personal or business-sensitive location data.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The file hard-codes Chinese-language address parsing rules, Chinese province and locality patterns, and a Chinese-only description, which effectively forces a specific locale. There is no natural-language indication that this locale restriction is optional, user-selected, or explicitly justified as a region-specific tool.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code sends extracted address data to the external Amap geocoding API whenever an API key is configured, but this file contains no consent gate, privacy notice, redaction, or control over what user-supplied text-derived location data leaves the system. Because this skill is explicitly designed to process customer, logistics, and document data, it is likely to handle sensitive personal address information, making silent third-party transmission a real privacy and compliance risk.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The file presents the skill description and operating instructions entirely in Chinese, which effectively imposes a single language/locale on users. The policy allows locale constraints when users are given a choice or when the restriction is clearly documented and justified, which is not stated here.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The entire skill reference is written only in Chinese and all examples, patterns, and address handling are specific to Chinese addresses, with no indication that this locale restriction is optional or intentionally scoped for a China-only use case. Under the policy, language or locale constraints should either provide user choice or be clearly documented and justified.

Static analysis

No suspicious patterns detected.