ClawHub
Back to skill

Security audit

test-ai-map-api

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate Baidu Maps integration, but it sends full requests and precise location data to Baidu without clear privacy or confirmation guidance.

Install only if you are comfortable sending map searches, route requests, addresses, precise coordinates, and the Baidu token-authenticated request context to Baidu Maps. Avoid using exact home, work, or sensitive locations unless you intentionally want those details processed by Baidu.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends user queries, addresses, routes, and precise coordinates to Baidu's external API, but the description and usage guidance do not clearly warn users that sensitive location data and free-form requests will leave the local environment. Because this skill is explicitly designed for map, routing, geocoding, and weather lookups, external transmission is expected, but the missing disclosure creates a real privacy and consent issue rather than malicious behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This line defines a third-party base URL, confirming that all skill operations transmit data to an external service. In context, this is core functionality rather than covert exfiltration, but it still creates a privacy/security boundary because location data, addresses, and user travel intent are sent off-platform.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
所有能力统一使用：

> **Base URL**: `https://api.map.baidu.com/`

### 准则 2：SK 凭证安全处理

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The example transmits a natural-language user request to Baidu, which may include preferences and potentially sensitive behavioral information. This is expected for the skill's function, but without an upfront warning or consent model it is a genuine external data-sharing risk.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

示例：

bash
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=帮我找北京可带宠物的咖啡馆" \
  --data-urlencode "region=北京市"

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example sends a location-related lodging query to an external endpoint, disclosing travel intent and destination context. While ordinary for a map skill, the combination of semantic request content and third-party transmission can expose sensitive patterns if users are not informed.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

bash
# 1) 帮我查一下八达岭长城附近的五星级酒店
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=帮我查一下八达岭长城附近的五星级酒店" \
  --data-urlencode "region=延庆区" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This example sends both a semantic request and precise center coordinates to a third party, which can disclose a user's current or proximate location with high precision. In a mapping skill this is functionally relevant, but precise geolocation substantially increases privacy sensitivity compared with ordinary web requests.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
--data-urlencode "sort=relevance"

# 2) 离我最近的火锅店（distance 排序）
curl --get "https://api.map.baidu.com/agent_plan/v1/place" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "user_raw_request=离我最近的火锅店" \
  --data-urlencode "region=北京市" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This route-planning example sends the user's travel request and location context to Baidu. Even though routing inherently requires external processing here, origin/destination data may reveal sensitive movement patterns and should be treated as privacy-impacting.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

bash
# 1) 帮我规划从故宫到颐和园的驾车路线
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=帮我规划从故宫到颐和园的驾车路线" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This example transmits a 'home' alias together with exact coordinates and a POI identifier, which can directly expose a sensitive residence-like location to a third party. In context this is especially dangerous because '我家' implies a highly sensitive personal location, raising the privacy impact beyond a generic map lookup.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
--data-urlencode "location=39.914590,116.403770"

# 2) “我家”别名映射
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=步行去我家附近最近的中餐厅" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example sends a movement query involving named places to an external service, revealing route intent and potentially time-sensitive whereabouts. The behavior fits the skill's purpose, but it still represents third-party disclosure of user travel information.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
--data-urlencode "refer_pois=我家:fbc88a21464370106e3e1b52,40.092180,116.345310"

# 2) 交通方式推理改写：从王府井打车去三里屯要多久
curl -X POST "https://api.map.baidu.com/agent_plan/v1/direction" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "user_raw_request=从王府井驾车去三里屯要多久" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

Geocoding an address sends a full street address to Baidu, which may include homes, offices, or other sensitive places. This is required for geocoding, but it is still a real privacy risk if users are not clearly informed that exact addresses are disclosed externally.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

示例

bash
curl --get "https://api.map.baidu.com/agent_plan/v1/geocoding" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "address=北京市海淀区上地十街10号百度大厦" \
  --data-urlencode "region=北京市"

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

Reverse geocoding transmits precise coordinates to a third party, which can identify a user's exact location or a sensitive site. Because the skill emphasizes 6-decimal precision, the privacy exposure is significant even though the transmission is intentional.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

示例

bash
curl --get "https://api.map.baidu.com/agent_plan/v1/reverse_geocoding" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "location=40.056800,116.308300"

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The weather example sends exact coordinates to Baidu, which may unnecessarily expose precise location when a less specific region could suffice. In context this is more dangerous than typical weather lookups because precise coordinates are shown as a standard pattern without a warning or privacy-preserving alternative.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

bash
# 1) 按坐标查询天气
curl --get "https://api.map.baidu.com/agent_plan/v1/weather" \
  -H "Authorization: Bearer $BAIDU_MAP_AUTH_TOKEN" \
  --data-urlencode "location=38.766230,116.432130"

Static analysis

No suspicious patterns detected.