tencentmap-lbs-skill
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
scripts/send_code.py,scripts/create_key.py,scripts/save_config.py) to facilitate the trial API key application process and local configuration storage. It also invokes thetmap-lbsCLI for map service operations.\n- [EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of the@tencent-map/lbs-skillsNode.js package from the official registry.\n- [DATA_EXFILTRATION]: User phone numbers are collected and transmitted to the official Tencent service domainlbsconsole.map.qq.comfor the specific purpose of generating trial API keys, as described in the trial key application flow.\n- [PROMPT_INJECTION]: The skill defines a potential indirect prompt injection surface by ingesting external data from user-provided URLs for trajectory visualization inreferences/scene5-trail-map.md. 1. Ingestion points: Data URL parameter provided by the user. 2. Boundary markers: Absent. 3. Capability inventory:tmap-lbs trailcommand execution. 4. Sanitization: Not explicitly documented beyond standard URL encoding.
Audit Metadata