T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fetch_url.py:52- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
baidu_search
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Baidu search purpose, but its web-fetch helper has unsafe defaults that can reach arbitrary network locations and accept tampered HTTPS content.
Install only if you are comfortable with a Chinese-language Baidu/webpage-fetching skill that can contact arbitrary result URLs from your machine. Avoid using it on hosts with access to private internal services or cloud metadata, and prefer fixing TLS verification, adding URL/network restrictions, removing the current-directory import path, and pinning dependencies before routine use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_url.py:52- Finding
TLS Certificate Verification Is Disabled
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/search_and_fetch.py:25- Finding
Current-Working-Directory Import Precedence Enables Module Hijacking
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:83- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Constraints
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include generic actions like '抓取网页' and '解析网页', which are broader than the stated Baidu-search purpose and could cause the agent to invoke this skill for unrelated web-fetching tasks. That increases the chance of unintended outbound requests and overbroad capability activation, especially when user intent is ambiguous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises webpage fetching and parsing but does not clearly disclose that it will make outbound requests to third-party websites beyond Baidu. This can surprise users or higher-level agents, and in some environments may bypass expectations around network access, privacy review, or domain allowlisting.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script's user-facing natural language is entirely Chinese, including the module description, CLI help text, status messages, and error guidance. This imposes a specific language/locale on all users without offering opt-in, selection, or justification for a region-specific audience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, CLI description, help text, and status/error messages are written only in Chinese, which imposes a specific language on all users. Under the policy, language constraints should either offer a choice or be clearly justified as region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script explicitly disables TLS certificate verification when fetching arbitrary user-supplied URLs. This enables man-in-the-middle attacks, allowing an attacker on the network or behind a malicious proxy to intercept or modify fetched content while the script treats the connection as trusted.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using
verify=Falsemakes HTTPS transport unauthenticated, defeating one of the main security guarantees of TLS. In this skill's context—a generic URL-fetching utility that may access arbitrary external sites—this is more dangerous because users are likely to rely on it for accurate remote content retrieval and may unknowingly accept tampered responses.- Content
python try: # 禁用 SSL 验证（某些环境可能需要） response = requests.get(url, headers=headers, timeout=timeout, verify=False) response.raise_for_status() response.encoding = response.apparent_encoding
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This is a natural-language policy issue because the file presents its purpose, usage, and options exclusively in Chinese. There is no opt-in, alternate locale, or explanation that the tool is intended only for a Chinese-speaking or region-specific context.
- Content