Turing Baidu Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:01 AM UTC
• Version: 1.0.0

Overview

This Baidu search skill does what it claims, but it can send user queries and bearer credentials to any configured API base URL without validation.

Review before installing if you will use real Turing credentials or sensitive search terms. Use only a trusted HTTPS Turing API base, avoid putting secrets or personal data in search queries, and consider hardening the script to allowlist the proxy host before forwarding bearer credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts.py:28

Finding

Unrestricted API Base URL Can Exfiltrate Credentials and Enable SSRF

Content

View full analysis

Vulnerability Details

File Location: scripts.py:28-38 and scripts.py:69-73
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: Medium

Vulnerable Code

python

def baidu_search(api_key: str, client: str, environment: str, api_base: str, request_body: dict) -> dict:
    url = f"{api_base}/api/v1/proxy/baidu/search"

    headers = {
        "Authorization": f"Bearer {api_key}",
        "client": client,
        "environment": environment,
        "Content-Type": "application/json",
        "User-Agent": "openclaw-baidu-web-search",
    }

    response = requests.post(url, json=request_body, headers=headers, timeout=30)

The destination is obtained from configuration without validation:

python

_cfg        = _load_env_from_config()
api_key     = _getcfg("TURING_API_KEY", _cfg)
client      = _getcfg("TURING_CLIENT", _cfg)
environment = _getcfg("TURING_ENVIRONMENT", _cfg)
api_base    = (_getcfg("TURING_API_BASE", _cfg) or "https://live-turing.cn.llm.tcljd.com").rstrip("/")

Technical Analysis

The script supports a configurable TURING_API_BASE, then unconditionally sends the bearer API key, client identifier, environment identifier, and user-supplied search query to that destination. It does not verify the URL scheme, hostname, port, or resolved network address.

Sending these values to the documented Turing proxy is necessary for the Skill's declared web-search functionality. Allowing the same credentials to be forwarded to an arbitrary destination exceeds the minimum network privilege required for that functionality.

A malicious or incorrectly modified configuration can set TURING_API_BASE to an attacker-controlled server. Plain HTTP is also accepted, which can expose credentials and query contents to network observers. Setting the value to a loopback, private, link-local, or other internal address creates an SSRF primitive from the en ...[truncated 1869 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove TURING_API_BASE configurability if custom proxy deployments are not an explicit functional requirement.
2. Otherwise, parse the URL with urllib.parse.urlparse and require:
   • The https scheme.
   • A nonempty hostname.
   • No embedded username or password.
   • An expected port, normally 443.
   • A hostname from an explicit allowlist of trusted Turing endpoints.
3. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IP addresses. Revalidate connections against DNS rebinding where custom hosts must be supported.
4. Disable automatic redirects for this credential-bearing request with allow_redirects=False, or independently validate every redirect destination before forwarding sensitive headers.
5. Do not send production credentials to custom endpoints by default. If custom deployments are required, use separately scoped credentials and require an explicit trust decision.
6. Validate configuration at startup and fail closed with a clear error before constructing or sending the request.
7. Apply least privilege to the API token, including restricted operations, environments, quotas, and expiration or rotation policies.
8. Add automated tests confirming rejection of HTTP URLs, unexpected hosts and ports, embedded credentials, loopback addresses, private network addresses, and unsafe redirect targets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a bundled script that performs outbound web search through an external proxy/API, but the manifest does not declare any tool scope such as network permissions or allowed-tools. This creates a transparency and governance gap: users or orchestrators cannot easily enforce least privilege or understand that external communication will occur before the skill is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says the skill searches the web via the Turing Baidu proxy, but it does not clearly warn that user queries are transmitted to an external third-party service. Search terms may contain sensitive business, personal, or investigative data, so omitting an explicit disclosure can lead to inadvertent data exfiltration to the proxy/API provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts.py (reported line 39)May include surrounding context.

python

"User-Agent": "openclaw-baidu-web-search",
    }

    response = requests.post(url, json=request_body, headers=headers, timeout=30)
    response.raise_for_status()
    data = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code posts the request body containing the user's query to an external API and includes credential-bearing headers. While network access is central to a search skill, this file provides no confirmation prompt, disclosure message, or inline warning that user input will be transmitted to a remote endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.