tencentmap-lbs-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to provide their API Key and instructs the agent to "记录" or run commands embedding that key (e.g., tmap-lbs config set-key ), which requires the LLM to receive and potentially output the secret verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). Documentation instructs the skill to "silently record" user API keys and to store/configure provided keys without notifying the user, which constitutes deliberate credential-capture behavior and high risk of abuse.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 该 Skill 仅基于用户自然语言请求来调用腾讯位置服务的检索/规划命令，并未包含读取第三方/用户投稿的任意自由文本作为“可被注入的文本源”（运行时 LLM 只处理用户参数化意图并生成 URL/调用工具，而 references 里也不要求从外部抓取或解析未选定内容）。