ClawHub
Back to skill

Security audit

baidu baike search

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Baidu Baike lookup helper, with the main caveat that search terms are sent to Baidu.

Install only if you are comfortable providing a Baidu API key and sending lookup terms to Baidu's service. Avoid using it for secrets, confidential project names, private identifiers, or sensitive personal data unless that disclosure is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill sends user-supplied query terms to Baidu's external service but does not disclose this data flow or advise against sending sensitive information. In an agent setting, users may unknowingly submit personal, confidential, or regulated data, creating privacy, compliance, and data-governance risk even if the transport itself is authenticated.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.