Qianfan KnowledgeBase Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:43 PM UTC
• Version: 1.0.1

Overview

The skill appears to perform the advertised Baidu Qianfan knowledge-base search, but it handles private queries and API-backed access while printing request data to standard output.

Review this skill before installing if your searches may contain confidential information. It requires a Baidu Qianfan API key, sends query text and knowledge-base identifiers to Baidu Qianfan, and currently logs the full input request; removing or redacting that diagnostic print would reduce privacy risk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: search.py:47

Finding

Sensitive Search Request Data Exposed in Standard Output

Content

View full analysis

Vulnerability Details

File Location: search.py, line 47
Vulnerability Type: Sensitive data exposure through diagnostic logging
Risk Level: Medium

Vulnerable Code

python

print(f"success parse request body: {parse_data}")

Technical Analysis

The script writes the complete parsed request object to standard output. This object can contain confidential search queries, private knowledge-base identifiers, and any additional caller-supplied fields. Standard output is commonly captured by agent runtimes, process supervisors, CI systems, and centralized logging services.

Logging the full request is unnecessary for the Skill's declared search functionality and creates a secondary disclosure channel outside the intended encrypted request to Baidu Qianfan. Although the BAIDU_API_KEY is read separately from the environment and is not directly printed by this statement, secrets accidentally included in the input object would also be recorded.

The flagged outbound network behavior itself is consistent with the declared functionality: search.py sends the query and knowledge-base IDs to the documented HTTPS Baidu Qianfan search endpoint and supplies the required API key in an authorization header. No evidence of transmission to an undeclared destination was found.

Attack Path

1. A user or agent invokes the Skill with a confidential query, private knowledge-base IDs, or an accidentally embedded secret.
2. The script parses the JSON argument into parse_data.
3. Line 47 prints the entire object before making the API request.
4. The surrounding runtime, process manager, or logging service captures standard output.
5. An attacker or lower-privileged operator with access to those logs retrieves the disclosed information.

Exploitation requires access to captured process output or downstream logs; this code does not independently grant such access.

Impact Assessment

The issue can disclose priv ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

Remove the diagnostic statement or replace it with a fixed message that does not include user-controlled data:

python

print("Request body parsed successfully.")

If detailed diagnostics are operationally necessary:

• Make verbose logging explicitly opt-in and disabled by default.
• Never log query text, authorization values, or complete request objects.
• Redact knowledge-base identifiers and any fields that may contain secrets.
• Restrict access to runtime logs and configure short retention periods.
• Review existing retained logs and securely delete copies containing sensitive request data.
• Prefer structured logging with an explicit allowlist of non-sensitive fields.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises required environment variables and describes executing a Python script that makes outbound API requests, but it does not declare an explicit permission or allowed-tools scope. That creates a governance gap: a caller may not be clearly informed that the skill can access secrets from the environment and send data over the network, increasing the chance of unintended secret use or external data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is specifically designed to query a third-party Baidu Qianfan API against private knowledge bases, yet the user-facing description does not warn that prompts, identifiers, and potentially sensitive knowledge-base content will be transmitted to an external service. In this context, that omission is security-relevant because users may unknowingly submit confidential queries or retrieve sensitive private data through a remote provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code performs an outbound HTTPS POST containing the full request body and bearer-authenticated access to a third-party service. Because the skill is designed to work with a user's private knowledge base, the transmitted query and metadata may be sensitive, and there are no guardrails such as consent, content filtering, logging controls, or destination configurability checks beyond the hardcoded host.

Content

Scanner excerpt · search.py (reported line 30)May include surrounding context.

python

"Content-Type": "application/json"
    }

    response = requests.post(url, json=request_body, headers=headers)
    response.raise_for_status()
    return response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill sends the user's query and selected knowledge base identifiers directly to Baidu Qianfan's external API, but the code provides no user-facing notice, consent step, or minimization guard before transmitting potentially sensitive private-knowledgebase content or queries. In this skill's context, the whole purpose is remote retrieval from a private cloud knowledge base, so external transmission is expected, but the lack of transparency and explicit disclosure still creates a real privacy/security risk rather than a false positive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The module docstring presents the skill description exclusively in Chinese, with no indication that other languages are supported or that the locale constraint is intentional. This can be a natural-language policy issue if organizational policy requires language neutrality or user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.