Security audit

Baidu image recognize

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does the advertised Baidu image recognition, but it needs review because it may reuse API keys from prior chat context and sends user images to Baidu.

Install only if you are comfortable sending selected images, image URLs, and derived results to Baidu. Use a restricted Baidu API key, avoid sensitive photos or private/internal URLs, and do not rely on prior pasted credentials being safely scoped for this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill uses sensitive capabilities like environment-variable access and network communication but does not declare permissions or clearly surface those capabilities to the user. This weakens transparency and policy enforcement, making it easier for the skill to access secrets and send data externally without adequate review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill claims to perform image recognition, but its documented behavior also includes fetching remote images, retrieving similar images, and returning external reference content. That broader behavior increases data exposure and can cause users to unknowingly trigger third-party requests or receive externally sourced content beyond simple classification.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill description says it is for image recognition, but the implementation also performs and exposes reverse-image-search style results from rag_data.search_results, including external URLs and related web content. This broadens data use beyond the declared scope and can leak sensitive information about a user-supplied image by correlating it with public web results, which is especially risky for personal or private images.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger condition is broad enough to activate on many ordinary image-related requests, which increases the chance the skill runs when the user did not intend third-party image analysis. In this context, over-triggering matters because the skill may send image content or URLs to Baidu and may use stored credentials automatically.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documentation does not warn users that provided images or remote image URLs will be sent to Baidu, a third-party service. This is a privacy and data-handling issue because users may submit sensitive local images, personal photos, or confidential URLs without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to extract an API key from prior conversation context without any warning about credential sensitivity or scope. This creates a risk of mishandling secrets that were previously shared for a different purpose and normalizes unsafe credential reuse.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Recovering API keys from earlier conversation context can leak or reuse secrets outside the user's current intent, especially in multi-step or mixed-topic sessions. In a skill that performs network requests, this increases the chance that previously shared credentials are silently used in later tool invocations.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.