baidu_search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:05 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Baidu search purpose, but its web-fetch helper has unsafe defaults that can reach arbitrary network locations and accept tampered HTTPS content.

Install only if you are comfortable with a Chinese-language Baidu/webpage-fetching skill that can contact arbitrary result URLs from your machine. Avoid using it on hosts with access to private internal services or cloud metadata, and prefer fixing TLS verification, adding URL/network restrictions, removing the current-directory import path, and pinning dependencies before routine use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fetch_url.py:52
• Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_url.py:52` **Vulnerability Type**: Server-Side Request Forgery (SSRF) **Risk Level**: High ### Vulnerable Code ```python response = requests.get(url, headers=headers, timeout=timeout, verify=False) ``` ### Technical Analysis The `url` argument is passed directly to `requests.get()` without validating its scheme, destination hostname, resolved IP address, port, or redirect chain. The URL can originate directly from a command-line argument or indirectly from a Baidu search result processed by `search_and_fetch.py`. The implementation does not prevent requests to: - Loopback addresses such as `127.0.0.1` or `::1` - RFC 1918 private networks - Link-local addresses such as `169.254.0.0/16` - Cloud instance metadata services - Internal DNS names and services - Reserved or multicast IP ranges - Redirect targets that resolve to restricted addresses - Nonstandard ports exposed only to the local host or private network A simple hostname allowlist check would not be sufficient because DNS rebinding, alternative IP representations, IPv6 addresses, and HTTP redirects could bypass it. Validation must occur after DNS resolution and after every redirect. ### Attack Path 1. An attacker supplies a URL to `scripts/fetch_url.py`, or influences a URL returned in the search results consumed by `scripts/search_and_fetch.py`. 2. The URL points directly to an internal service or redirects to an internal address. 3. `fetch_url()` passes the untrusted URL to `requests.get()` without destination validation. 4. The request is issued with the network privileges of the host running the Skill. 5. The internal service response is parsed and returned through console or JSON output. 6. Depending on the accessible endpoint, the attacker may obtain internal service information, cloud metadata, credentials, or other data unavailable from an external network. ### Impact Assessment Successful exploitation can cross netwo ...[truncated 435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only explicitly supported schemes, normally `http` and `https`. 2. Parse URLs using `urllib.parse.urlsplit()` and reject embedded credentials, malformed hostnames, and unexpected ports. 3. Resolve the hostname before connecting and reject every address that is loopback, private, link-local, multicast, reserved, or unspecified. 4. Explicitly block cloud metadata hosts and addresses, including link-local metadata endpoints. 5. Disable automatic redirects or validate every redirect destination using the same resolution and IP-range rules. 6. Protect against DNS rebinding by connecting only to validated resolved addresses while preserving correct TLS hostname verification. 7. Consider an explicit domain allowlist when the business workflow permits it. 8. Apply egress firewall rules so the process cannot reach internal or metadata networks. 9. Add tests covering IPv4, IPv6, encoded IP representations, internal DNS names, redirects, and DNS rebinding scenarios. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_url.py:52
• Finding: TLS Certificate Verification Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch_url.py:52` **Vulnerability Type**: Improper Certificate Validation **Risk Level**: Medium ### Vulnerable Code ```python response = requests.get(url, headers=headers, timeout=timeout, verify=False) ``` ### Technical Analysis The `verify=False` argument disables TLS certificate-chain and hostname verification for every HTTPS request. Consequently, encryption alone does not establish that the remote endpoint is the intended server. An attacker with a suitable network position can present an arbitrary certificate and intercept or modify the response. Because the fetched page is parsed and emitted as trusted-looking title and body content, modified content may also affect downstream users or agents that consume the result. This setting applies globally to every request made by `fetch_url()` rather than being limited to a narrowly controlled development environment. ### Attack Path 1. The Skill requests an HTTPS URL. 2. An attacker capable of intercepting network traffic performs a man-in-the-middle attack. 3. The attacker presents an untrusted or hostname-mismatched certificate. 4. The request succeeds because certificate verification is disabled. 5. The attacker reads the request and supplies modified webpage content. 6. The manipulated content is parsed and returned to the user or downstream agent as if it came from the requested site. ### Impact Assessment A successful attack can compromise the confidentiality and integrity of fetched HTTPS traffic. Search results, extracted webpage text, and any sensitive URL parameters may be exposed or altered. The direct privileges are limited to the intercepted network exchange, but manipulated content could mislead users or downstream automation and could amplify content-based attacks against systems consuming the output. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `verify=False` and use the `requests` default certificate verification: ```python response = requests.get(url, headers=headers, timeout=timeout) ``` 2. If a private certificate authority is required, configure an explicit trusted CA bundle rather than disabling verification: ```python response = requests.get( url, headers=headers, timeout=timeout, verify="/path/to/trusted-ca-bundle.pem", ) ``` 3. Do not add blanket suppression for insecure-request warnings. 4. Fail closed when certificate validation fails and return a sanitized error. 5. Keep the operating system and Python CA trust stores current. 6. Add tests confirming that expired, self-signed, and hostname-mismatched certificates are rejected. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/search_and_fetch.py:25
• Finding: Current-Working-Directory Import Precedence Enables Module Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_and_fetch.py:25-26` **Vulnerability Type**: Python Module Search-Path Hijacking **Risk Level**: High ### Vulnerable Code ```python sys.path.insert(0, '.') from fetch_url import fetch_url ``` ### Technical Analysis The script inserts the current working directory at the beginning of `sys.path` and then imports `fetch_url` by its unqualified module name. The current working directory is not necessarily the directory containing `search_and_fetch.py`. If an attacker can place a file named `fetch_url.py` in the directory from which the command is launched, Python will import that file instead of the bundled implementation. Python executes module-level code during import, so the malicious module does not need to wait for `fetch_url()` to be called. This can occur even if the legitimate Skill files themselves are read-only, because the attacker only needs write access to the process's working directory. ### Attack Path 1. An attacker obtains write access to a directory from which a user or agent may launch `search_and_fetch.py`. 2. The attacker creates a malicious `fetch_url.py` in that directory. 3. The user launches the legitimate script while that directory is the current working directory. 4. `sys.path.insert(0, '.')` gives the attacker-controlled directory highest import precedence. 5. `from fetch_url import fetch_url` loads and executes the attacker's module. 6. The malicious code runs with the same filesystem, network, environment, and process privileges as the invoking user or agent. ### Impact Assessment Successful exploitation permits arbitrary Python code execution under the identity running the Skill. The attacker may access files and environment variables available to that identity, make network requests, modify user-writable data, or impersonate the expected fetch operation. The vulnerability does not inherently elevate privileges beyond the invoking account, but it fully c ...[truncated 77 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package the scripts as a Python package and use an explicit relative import: ```python from .fetch_url import fetch_url ``` 2. When direct script execution must remain supported, resolve the module from the trusted script directory rather than the current working directory. 3. Remove `sys.path.insert(0, '.')`. 4. Avoid adding user-controlled or writable directories to the beginning of `sys.path`. 5. Launch the module through a package entry point, for example: ```bash python3 -m scripts.search_and_fetch ``` 6. Ensure the installed Skill package and its parent directories are not writable by untrusted users. 7. Add a test that launches the command from a directory containing a decoy `fetch_url.py` and verifies that the bundled module is still imported. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:83
• Finding: Third-Party Dependencies Are Installed Without Version or Integrity Constraints<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:83` **Vulnerability Type**: Unpinned and Unverified Third-Party Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install --user baidusearch requests beautifulsoup4 lxml ``` ### Technical Analysis The documented installation command installs the latest versions available at installation time without exact version constraints, a lockfile, cryptographic hashes, or a controlled package index. Python packages can execute code during installation and later during import. Consequently, the effective code used by the Skill can change after the Skill itself has been reviewed. A compromised upstream release, account takeover, dependency substitution, or incompatible future release could therefore affect Skill execution. The audit found no evidence that the named packages are currently malicious. The finding concerns the absence of reproducible and integrity-verified dependency controls. ### Attack Path 1. A package publisher account, distribution channel, or upstream release is compromised, or a future unsafe release is published. 2. A user follows the documented unconstrained `pip3 install` command. 3. Package resolution selects the affected release because no reviewed version is pinned. 4. Malicious or vulnerable code executes during installation, import, or normal Skill operation. 5. The code runs with the privileges of the installing or invoking user. ### Impact Assessment The potential impact is arbitrary code execution in the installation or runtime context. Depending on the invoking account, affected resources may include user files, environment variables, network credentials, and any services reachable from the host. Exploitability depends on a supply-chain compromise or unsafe upstream release; no such compromise was established during this source audit. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version. 2. Generate and commit a lockfile containing transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and `pip --require-hashes`. 4. Install dependencies inside an isolated virtual environment rather than the user's global package directory. 5. Use a trusted, explicitly configured package index or an internally controlled mirror. 6. Run automated dependency vulnerability and provenance checks during release preparation. 7. Review and intentionally update dependencies instead of automatically selecting the newest release. 8. Document the expected package source and verify that package names, maintainers, and artifacts match the reviewed dependencies. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases include generic actions like '抓取网页' and '解析网页', which are broader than the stated Baidu-search purpose and could cause the agent to invoke this skill for unrelated web-fetching tasks. That increases the chance of unintended outbound requests and overbroad capability activation, especially when user intent is ambiguous.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill advertises webpage fetching and parsing but does not clearly disclose that it will make outbound requests to third-party websites beyond Baidu. This can surprise users or higher-level agents, and in some environments may bypass expectations around network access, privacy review, or domain allowlisting.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script's user-facing natural language is entirely Chinese, including the module description, CLI help text, status messages, and error guidance. This imposes a specific language/locale on all users without offering opt-in, selection, or justification for a region-specific audience.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring, CLI description, help text, and status/error messages are written only in Chinese, which imposes a specific language on all users. Under the policy, language constraints should either offer a choice or be clearly justified as region-specific.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script explicitly disables TLS certificate verification when fetching arbitrary user-supplied URLs. This enables man-in-the-middle attacks, allowing an attacker on the network or behind a malicious proxy to intercept or modify fetched content while the script treats the connection as trusted.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

try:
        # 禁用 SSL 验证（某些环境可能需要）
        response = requests.get(url, headers=headers, timeout=timeout, verify=False)
        response.raise_for_status()
        response.encoding = response.apparent_encoding

• Confidence: 99% confidence
• Finding: Using `verify=False` makes HTTPS transport unauthenticated, defeating one of the main security guarantees of TLS. In this skill's context—a generic URL-fetching utility that may access arbitrary external sites—this is more dangerous because users are likely to rely on it for accurate remote content retrieval and may unknowingly accept tampered responses.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This is a natural-language policy issue because the file presents its purpose, usage, and options exclusively in Chinese. There is no opt-in, alternate locale, or explanation that the tool is intended only for a Chinese-speaking or region-specific context.

Static analysis

No suspicious patterns detected.