ClawHub
Back to skill

Security audit

Baidu Search V2

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Baidu web-search skill, though users should avoid sensitive queries because the script sends them to Baidu and prints the parsed request to stdout.

Install only if you are comfortable sending searches to Baidu's API. Do not use it for secrets, personal data, or confidential business queries unless your environment's privacy and logging controls are appropriate; the request logging should ideally be removed or redacted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:36
Finding

Sensitive Search Query Exposed Through Standard Output Logging

Content
View full analysis

Vulnerability Details

File Location: scripts/search.py, line 36
Vulnerability Type: Plaintext logging of potentially sensitive input
Risk Level: Medium

Vulnerable Code

python
parse_data = json.loads(query)
print(f"success parse request body: {parse_data}")

Technical Analysis

The script logs the complete parsed request object to standard output. This object contains the user-supplied query and may also contain other request parameters.

Search queries can include confidential business information, personal data, credentials pasted accidentally, internal identifiers, or unreleased project details. In agent and automation environments, standard output is commonly captured by execution frameworks, centralized logging systems, CI/CD records, or monitoring services. The log statement therefore creates an unnecessary secondary copy of potentially sensitive information.

Logging the query is not required to perform the declared Baidu web-search functionality and exceeds the minimum data handling necessary for successful operation. The intentional transmission of the query and API credential to the fixed HTTPS Baidu API endpoint is consistent with the declared functionality; the additional local logging is not.

Attack Path

  1. A user or calling agent supplies JSON containing sensitive text in the query field.
  2. The script parses the JSON with json.loads.
  3. Line 36 interpolates the entire parsed object into a plaintext status message.
  4. The process writes that message to standard output.
  5. An execution platform, logging agent, or shell transcript captures and retains the output.
  6. A person or service with access to those logs can recover the sensitive query without requiring access to the Baidu API request in transit.

This issue does not directly grant code execution, elevated system privileges, or access to the BAIDU_API_KEY. Its scope is disclosure of user-provided request dat ...[truncated 706 chars]

Remediation
View remediation

Remediation Suggestions

Remove the logging of the parsed request body:

python
parse_data = json.loads(query)

If a success message is operationally necessary, use a constant message that does not contain user input:

python
parse_data = json.loads(query)
print("Request parsed successfully.")

Additional hardening measures:

  • Disable request-content logging by default.
  • If diagnostic logging is needed, make it explicitly opt-in and redact the query field.
  • Document that search queries are transmitted to Baidu's API and should not contain secrets.
  • Configure execution and centralized logging systems with access controls, short retention periods, and appropriate deletion policies.
  • Prefer structured logs with an allowlist of non-sensitive metadata rather than serializing complete request objects.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares access to environment variables and makes networked requests, but it does not define an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes the skill's external communication and secret usage less transparent to users and enforcement systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it searches the web but does not clearly warn that user-supplied queries are sent to Baidu, an external third-party service. Users may unknowingly submit sensitive prompts, internal identifiers, or confidential research topics to an outside provider, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 19)May include surrounding context.

python
}

    # 使用POST方法发送JSON数据
    response = requests.post(url, json=requestBody, headers=headers)
    response.raise_for_status()
    results = response.json()
    if "code" in results:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends requestBody to Baidu's web_search endpoint, which includes the user's query content assembled later in the file. While the code uses an environment variable for the API key, there is no confirmation prompt and no user-facing warning that input data will be sent to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill includes example queries and comments in Chinese, which may implicitly constrain expected usage language, but there is no statement that the skill is China-specific or that users may choose another language. This can create a natural-language policy issue if the organization expects skills not to force a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest describes a skill for performing live web searches via Baidu, but the code also accesses process environment state to retrieve a credential. While common in implementation, environment-variable access is a broader capability than the user-facing purpose and is not mentioned in the stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.