ClawHub
Back to skill

Security audit

Investment Advisor Zhang Openclaw Cn

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it claims, but needs review because direct execution can expose an unauthenticated Baidu API-key-backed search service to the network and it may log or return sensitive request/error data.

Install only if you are comfortable providing a Baidu API key and sending search queries to Baidu. Run it bound to 127.0.0.1 unless you add authentication, TLS, rate limits, and firewall controls; avoid sensitive search text because request bodies and upstream errors may appear in logs or client responses.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
src/baidu_search/main.py:44
Finding

Unauthenticated Search Endpoint Can Be Exposed on All Network Interfaces

Content
View full analysis

Vulnerability Details

File Location: src/baidu_search/main.py:44-59
Vulnerability Type: Missing authentication and unsafe default network exposure
Risk Level: Medium

Vulnerable Code

python
@app.post("/search", response_model=SearchResponse)
def web_search(request: SearchRequest) -> SearchResponse:
    return search(request)


if __name__ == "__main__":
    import uvicorn
    uvicorn.run("baidu_search.main:app", host="0.0.0.0", port=8001)

Technical Analysis

The /search endpoint performs upstream requests using the server-side BAIDU_API_KEY, but it does not require authentication or authorization. When the module is executed directly, Uvicorn binds to 0.0.0.0, making the endpoint available through every configured network interface unless an external firewall prevents access.

This differs from the documented command that binds the service to 127.0.0.1. Consequently, an operator who launches the module directly may unintentionally expose a credential-backed API proxy to other hosts. Attackers do not obtain the API key itself, but they can cause the application to use it on their behalf.

Attack Path

  1. An operator configures a valid BAIDU_API_KEY.
  2. The operator starts the service by executing baidu_search.main directly.
  3. Uvicorn listens on 0.0.0.0:8001.
  4. An attacker with network access identifies the exposed port.
  5. The attacker repeatedly sends valid JSON requests to /search.
  6. The service authenticates each upstream request with the operator's Baidu API key.
  7. The attacker consumes the account's API quota and associated resources without possessing the key.

Impact Assessment

A remote network-accessible attacker can submit arbitrary searches under the operator's Baidu account and consume its quota or incur usage costs. Repeated requests may also exhaust application workers or upstream capacity, causing denial of service for legitimate users.

...[truncated 184 chars]

Remediation
View remediation

Remediation Suggestions

  1. Change the direct-execution default to loopback-only binding:
    python
    uvicorn.run("baidu_search.main:app", host="127.0.0.1", port=8001)
  2. Require authentication for /search if remote access is necessary. Use a securely generated service credential, OAuth2, or authentication enforced by a trusted reverse proxy.
  3. Add per-client and global rate limits to prevent quota abuse and resource exhaustion.
  4. Restrict network access with firewall rules or private-network controls.
  5. Apply request quotas and monitor unusual request volumes and upstream consumption.
  6. Document that public exposure requires TLS, authentication, authorization, and rate limiting.

T09 · Insecure Skill Coding Practices

Note
Location
src/baidu_search/baidu_api.py:124
Finding

Sensitive Request and Upstream Error Data Is Logged or Returned to Clients

Content
View full analysis

Vulnerability Details

File Location: src/baidu_search/baidu_api.py:124-132; related request-body logging at src/baidu_search/main.py:27-40
Vulnerability Type: Excessive logging and raw upstream error disclosure
Risk Level: Low

Vulnerable Code

python
if response.status_code != 200:
    logger.error(
        "Baidu API error: status=%d, body=%s",
        response.status_code,
        response.text
    )
    raise HTTPException(
        status_code=response.status_code,
        detail=f"Baidu API error: {response.text}"
    )

Related validation-error logging:

python
@app.exception_handler(RequestValidationError)
async def validation_exception_handler(
    request: Request, exc: RequestValidationError
) -> JSONResponse:
    logger.error(
        "Validation error on %s %s. body=%s errors=%s",
        request.method,
        request.url.path,
        exc.body,
        exc.errors(),
    )
    return JSONResponse(
        status_code=422,
        content=jsonable_encoder({"detail": exc.errors()}),
    )

Technical Analysis

The application logs complete malformed request bodies through exc.body. Search queries may contain private, regulated, or otherwise sensitive information, and clients may accidentally place credentials in request fields. Such values can therefore persist in log storage and become accessible to log readers or monitoring systems.

For unsuccessful upstream requests, the complete response.text is both logged and embedded in the client-facing HTTPException. Raw upstream responses can contain diagnostic details, identifiers, service internals, or other information that should not cross the proxy's trust boundary.

The application also propagates the upstream HTTP status directly. Although status propagation is not inherently unsafe, combining it with an unfiltered upstream body allows unauthenticated callers to inspect any error ...[truncated 1087 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not log complete request bodies. Record only non-sensitive metadata such as the route, validation category, correlation ID, and sanitized field names.
  2. Replace raw upstream-body logging with a bounded, redacted diagnostic message:
    python
    logger.error(
    "Baidu API request failed: status=%d request_id=%s",
    response.status_code,
    request_id,
)
  3. Return a fixed client-facing error rather than response.text:
    python
    raise HTTPException(
    status_code=502,
    detail="The upstream search service returned an error.",
)
  4. Map upstream failures to controlled proxy status codes instead of automatically exposing provider statuses.
  5. Redact credentials, authorization values, tokens, personal information, and query contents from all logs.
  6. Configure restricted log access, retention limits, encryption, and monitoring for unauthorized access.
  7. Use correlation identifiers to support debugging without retaining complete sensitive payloads.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash
cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares capabilities that require environment-variable access and outbound network use, but it does not explicitly scope or disclose those permissions in the skill manifest. This weakens security review and user consent because the agent can access secrets and transmit queries externally without a clear least-privilege declaration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description states the skill searches the Chinese internet specifically, which imposes a locale/language constraint in the skill's behavior. The file does not indicate that users can opt into another language/locale or choose a broader search scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick Start

  1. 检查服务: curl http://127.0.0.1:8001/ping

  2. 搜索网页:

bash

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description is written entirely in Chinese ("百度 AI 搜索 API 代理服务"), which indicates a fixed language choice without any stated user opt-in or documented locale justification in this file. Under the policy, forcing a specific language or locale without choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The only natural-language description in this file is a Chinese-language module docstring, which indicates the skill is presented in a fixed language. There is no accompanying indication of user language choice, opt-in, or region-specific justification, which can conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The API title and description are presented only in Chinese ("百度搜索 API", "百度 AI 搜索代理服务"), which imposes a specific language choice in user-facing metadata. The file does not offer any language/locale option or explain that the skill is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.