tencentmap-lbs-skill

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts (scripts/send_code.py, scripts/create_key.py, scripts/save_config.py) to facilitate the trial API key application process and local configuration storage. It also invokes the tmap-lbs CLI for map service operations.\n- [EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of the @tencent-map/lbs-skills Node.js package from the official registry.\n- [DATA_EXFILTRATION]: User phone numbers are collected and transmitted to the official Tencent service domain lbsconsole.map.qq.com for the specific purpose of generating trial API keys, as described in the trial key application flow.\n- [PROMPT_INJECTION]: The skill defines a potential indirect prompt injection surface by ingesting external data from user-provided URLs for trajectory visualization in references/scene5-trail-map.md. 1. Ingestion points: Data URL parameter provided by the user. 2. Boundary markers: Absent. 3. Capability inventory: tmap-lbs trail command execution. 4. Sanitization: Not explicitly documented beyond standard URL encoding.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 07:18 AM
Security Audit — agent-trust-hub — tencentmap-lbs-skill