ClawHub
Back to skill

Security audit

test-ai-map-api

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Baidu Maps API helper; its location sharing is expected for map features, but users should be aware that precise queries and coordinates go to Baidu.

Install only if you are comfortable sending map searches, addresses, route requests, and precise coordinates to Baidu Maps using your Baidu API token. Avoid submitting sensitive home, work, or travel details unless needed, and use a scoped or revocable token where possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs sending full user requests, precise coordinates, addresses, and home-like aliases (for example, “我家” mappings) to Baidu APIs, but it does not require a user-facing notice or consent step before transmitting this personal data to a third party. In a maps skill, this context makes the transmission expected, but the combination of exact location, address, and free-form query content still creates meaningful privacy risk if users are not clearly warned.

External Transmission

Medium
Category
Data Exfiltration
Content
示例：

```bash
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=帮我找北京可带宠物的咖啡馆" \
  --data-urlencode "region=北京市"
Confidence
91% confidence
Finding
This example instructs transmitting the user's raw natural-language request to Baidu without any accompanying privacy warning or consent requirement. While external transmission is core to the skill's purpose, the skill normalizes sending potentially sensitive query content to a third party without guardrails, making this a real privacy/security issue rather than a harmless example.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1) 帮我查一下八达岭长城附近的五星级酒店
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=帮我查一下八达岭长城附近的五星级酒店" \
  --data-urlencode "region=延庆区" \
Confidence
88% confidence
Finding
The place-search example sends a detailed natural-language query about nearby accommodations to an external API. In context this is expected functionality, but the skill does not instruct the agent to warn the user that their destination interests and travel context are being shared with Baidu.

External Transmission

Medium
Category
Data Exfiltration
Content
--data-urlencode "sort=relevance"

# 2) 离我最近的火锅店（distance 排序）
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=离我最近的火锅店" \
  --data-urlencode "region=北京市" \
Confidence
95% confidence
Finding
This example transmits a precise center coordinate together with a nearby-search request, which can reveal the user's exact location to a third party. Exact location sharing is particularly sensitive, and the skill lacks any instruction to confirm user consent or reduce precision before transmission.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1) 帮我规划从故宫到颐和园的驾车路线
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=帮我规划从故宫到颐和园的驾车路线" \
Confidence
89% confidence
Finding
The route-planning example transmits route intent and a specific location coordinate to Baidu. Even though this is necessary for the feature, route requests can expose movement patterns and sensitive travel information, so omitting any privacy notice or consent step is a meaningful weakness.

External Transmission

Medium
Category
Data Exfiltration
Content
--data-urlencode "location=39.914590,116.403770"

# 2) “我家”别名映射
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=步行去我家附近最近的中餐厅" \
Confidence
97% confidence
Finding
This example includes an alias mapping for “我家” alongside exact coordinates and a place identifier, directly associating a home-related label with precise location data. That materially increases privacy risk because it can expose a user's residence or other highly sensitive personal place information to the external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
--data-urlencode "refer_pois=我家:fbc88a21464370106e3e1b52,40.092180,116.345310"

# 2) 交通方式推理改写：从王府井打车去三里屯要多久
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=从王府井驾车去三里屯要多久" \
Confidence
87% confidence
Finding
This direction example still sends detailed route intent and a precise current location to the external API. The transmission is functionally relevant, but the skill provides no privacy guardrails for sensitive movement and location data.

External Transmission

Medium
Category
Data Exfiltration
Content
#### 示例

```bash
curl --get "https://api.map.baidu.com/agent_plan/v1/geocoding" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "address=北京市海淀区上地十街10号百度大厦" \
  --data-urlencode "region=北京市"
Confidence
90% confidence
Finding
The geocoding example transmits a full street address to a third-party API, which is sensitive personal or business location data. In a mapping skill this is normal functionality, but the absence of a warning or consent step means users may not understand that exact addresses are being sent off-platform.

External Transmission

Medium
Category
Data Exfiltration
Content
#### 示例

```bash
curl --get "https://api.map.baidu.com/agent_plan/v1/reverse_geocoding" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "location=40.056800,116.308300"
```
Confidence
93% confidence
Finding
The reverse-geocoding example sends exact coordinates to an external service, which may reveal a user's current or historical presence at a particular location. Exact lat/long values are sensitive, and the skill does not require user awareness or consent for this sharing.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 1) 按坐标查询天气
curl --get "https://api.map.baidu.com/agent_plan/v1/weather" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "location=38.766230,116.432130"
```
Confidence
84% confidence
Finding
The weather example sends exact coordinates to a third-party API even though weather often can be served using a broader region. Because the skill allows precise location transmission without encouraging less sensitive alternatives, it creates avoidable privacy exposure.

Static analysis

No suspicious patterns detected.