amap
3 findings (1 high, 2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-05.
This Amap (高德地图) skill presents MODERATE to HIGH security risks primarily related to API key management and input handling. The most critical issues are: (1) Hardcoded API key exposure through environment variables and URL query parameters, making keys visible in logs, shell history, and network traffic, (2) Command injection vulnerabilities due to unsanitized user input being directly interpolated into shell commands, and (3) Privacy concerns from sending user location data to third-party APIs without disclosure. The skill lacks basic security controls like input validation, URL encoding, and secure credential management. While functional for its intended purpose, it requires significant security hardening before production use. The missing optional metadata fields are informational only and do not constitute security vulnerabilities.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
使用高德地图Web服务API进行地点搜索、天气查询和路线规划。
- Package
- 1 file, 3.0 KB
- SKILL.md
- 157 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
curl - Homepage
- https://lbs.amap.com/
SKILL.md covers: 高德地图 (Amap) · 何时使用 (触发条件) · 核心功能与用法 · 1. 天气查询 · 将 [城市adcode] 替换为实际的行政区编码, 例如北京是 110000 · 将 [城市adcode] 替换为实际的行政区编码 · 2. 地点搜索 (POI) · 将 [关键词] 和 [城市] 替换为用户提供的内容 · 3. 驾车路径规划 · 将 [起点经纬度] 和 [终点经纬度] 替换为实际坐标，格式为 "经度,纬度" · 4. 地理编码 (地址 → 坐标) · 将 [地址] 替换为用户提供的地址
Findings
HIGH Hardcoded API Key Exposure via Environment Variable Data Exfiltrationllm
The skill requires users to set their Amap API key as an environment variable (AMAP_KEY) which is then directly embedded in curl commands. This creates multiple security risks: (1) API keys exposed in shell history, (2) Keys visible in process listings, (3) No validation or sanitization of the key, (4) Keys transmitted in URLs (query parameters) rather than headers, making them visible in logs and network traffic. The skill provides no guidance on secure key management, rotation, or access controls.
SKILL.md
```bash
export AMAP_KEY="你的Web服务API Key"
```
All curl commands use: `key=$AMAP_KEY` in URL query parametersMEDIUM Command Injection Risk via Unsanitized User Input Command Injectionllm
All curl commands directly interpolate user-provided input (keywords, addresses, city names, coordinates) into URLs without any validation, sanitization, or encoding. An attacker could inject shell metacharacters or additional curl parameters through user input. For example, a malicious user could provide input like: '北京; curl attacker.com' or use backticks/command substitution. While the instructions show placeholder syntax [关键词], there's no guidance on proper input validation or URL encoding.
SKILL.md
Examples of vulnerable patterns:
```bash
curl "https://restapi.amap.com/v3/place/text?key=$AMAP_KEY&keywords=[关键词]&city=[城市]"
curl "https://restapi.amap.com/v3/geocode/geo?key=$AMAP_KEY&address=[地址]"
```
No input validation or URL encoding specifiedMEDIUM Potential Data Leakage via Third-Party API Data Exfiltrationllm
The skill sends user queries (location searches, addresses, routes) to Amap's external API servers without any privacy warnings or data handling disclosure. Users may unknowingly expose sensitive location data, travel patterns, or personal addresses to a third-party service. There's no information about: (1) What data Amap collects, (2) How long it's retained, (3) Whether it's shared with other parties, (4) Compliance with privacy regulations (GDPR, CCPA). The skill also lacks any mechanism to anonymize or minimize data sent to the API.
SKILL.md
All API calls send user data to restapi.amap.com:
- Location searches with keywords
- Specific addresses for geocoding
- Route planning with origin/destination
- Weather queries with city codes
No privacy warnings or data handling documentation providedWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.0 KB |
External hosts referenced
restapi.amap.com lbs.amap.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
AMAP_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/amap
- Raw scan result: amap-scan.json
- Badge for your README:
- Request a re-scan