Baidu Search.Bak

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:50 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Baidu web-search helper that uses a configured Baidu API key and sends user search queries to Baidu as expected.

Before installing, treat BAIDU_API_KEY as a secret and avoid putting sensitive, private, or proprietary terms in searches because query text is sent to Baidu's external API. Review local OpenClaw config permissions if you store the key there.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares access to environment variables and performs external web search, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for the platform or users to understand and constrain what the skill can access, increasing the risk of unintended data exposure or overbroad execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description explains that it searches via Baidu AI Search API, but it does not clearly warn users that their queries will be transmitted to an external third-party service. Users may unknowingly send sensitive prompts, internal terms, or proprietary research topics off-platform, creating privacy and confidentiality risks.

Session Persistence

Medium

• Category: Rogue Agent

Content

Visit: **https://console.bce.baidu.com/ai-search/qianfan/ais/console/apiKey**

- Log in to your Baidu Cloud account
- Create an application or view existing API keys
- Copy your **API Key** (only API Key is needed)

### 2. Configure OpenClaw

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide directs users to store a live API key in a local JSON configuration file but does not warn that the credential is sensitive, should be protected with restrictive file permissions, and must not be committed, shared, or logged. This increases the risk of credential disclosure through local compromise, backups, screenshots, support bundles, or accidental source-control check-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

    # 使用POST方法发送JSON数据
    response = requests.post(url, json=requestBody, headers=headers)
    response.raise_for_status()
    results = response.json()
    if "code" in results:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: At L019, the code performs an HTTP POST to a third-party endpoint using request data derived from the user's input. Although the script logs parsed input and errors, it does not clearly warn the user that their query content will be transmitted to an external service.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The examples and sample queries are exclusively in Chinese, which can imply a fixed language expectation for use of the skill. Because no opt-in or language choice is stated, this may conflict with a policy requiring skills not to force a specific language or locale without user selection.

Static analysis

No suspicious patterns detected.