dasfgg

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Baidu web-search skill, but users should avoid sending sensitive queries because the query goes to Baidu and is also printed to stdout.

Install only if you are comfortable sending search terms to Baidu's external API. Do not search for secrets, regulated personal data, confidential project names, or credentials with this skill, and be aware that the current script echoes the submitted request to stdout where logs may retain it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search.py:38

Finding

Sensitive Search Query Disclosure Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, line 38
Vulnerability Type: Sensitive data exposure through logging
Risk Level: Medium

Vulnerable Code:

python

try:
    parse_data = json.loads(query)
    print(f"success parse request body: {parse_data}")
except json.JSONDecodeError as e:
    print(f"JSON parse error: {e}")

Technical Analysis

After parsing the command-line JSON request, the script prints the complete request object to standard output. This object includes the user-supplied query and may also contain other request parameters.

Search queries can contain personal information, confidential project names, internal infrastructure identifiers, authentication material pasted accidentally, or other sensitive data. Agent platforms, process supervisors, CI systems, and container runtimes commonly collect standard output in persistent logs. Consequently, data supplied for the search can be disclosed to parties with access to those logs.

Printing the request is not necessary for the declared web-search functionality and therefore exceeds the minimum data handling required by the Skill. The API credential itself is not included in this output.

Attack Path

1. A user or upstream Agent submits a request containing sensitive content in the query field.
2. The script parses the JSON request.
3. Line 38 writes the entire parsed request, including the sensitive query, to standard output.
4. The execution environment captures standard output in an Agent transcript, centralized logging service, terminal recording, CI log, or process-supervisor log.
5. A user or service with access to those records obtains the disclosed query.

This path does not grant operating-system privileges or code execution. Its scope is the confidentiality of submitted search data and any systems that retain or expose the resulting logs.

Impact Assessment

An attacker or unauthorized log re ...[truncated 405 chars]

Remediation

View remediation

Remediation Suggestions

Remove the request-content logging statement entirely:

python

parse_data = json.loads(query)

If operational diagnostics are necessary:

• Log only a generic event such as Request parsed successfully.
• Do not log the query or the complete request object.
• Keep diagnostic logging disabled by default.
• Apply explicit redaction before logging any user-controlled structure.
• Configure runtime logs with restrictive access controls, short retention periods, and encryption where appropriate.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search.py:18

Finding

Outbound API Request Lacks Connection and Read Timeouts

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, line 18
Vulnerability Type: Unbounded outbound network operation
Risk Level: Low

Vulnerable Code:

python

response = requests.post(url, json=requestBody, headers=headers)
response.raise_for_status()
results = response.json()

Technical Analysis

The call to requests.post does not specify a timeout. The Requests library does not impose a default timeout, so the operation may remain blocked indefinitely if connection establishment or response delivery stalls.

The outbound request itself is necessary for the Skill's declared Baidu search functionality. It uses HTTPS and targets the fixed Baidu endpoint https://qianfan.baidubce.com/v2/ai_search/web_search. The defect is the absence of resource bounds rather than an unauthorized network destination.

A remote service failure, network fault, or intentionally delayed response can retain the executing worker and prevent the Skill invocation from completing.

Attack Path

1. A user or Agent invokes the Skill with a valid search request.
2. The script sends the request to the fixed Baidu API endpoint.
3. The endpoint or an intervening network component accepts or partially processes the connection but does not complete the response.
4. Because no connection or read timeout is configured, the Python process remains blocked.
5. Repeated stalled invocations can occupy multiple Agent workers or exhaust execution capacity.

Exploitation generally requires influence over the remote service or network path, or an ordinary service outage. It does not provide local code execution, credential access, or elevated system privileges.

Impact Assessment

The principal impact is reduced availability. A single invocation may hang indefinitely, while repeated invocations can consume worker slots, memory, file descriptors, and orchestration capacity.

The affected scope is limited to the Skill p ...[truncated 130 chars]

Remediation

View remediation

Remediation Suggestions

Configure bounded connection and read timeouts:

python

response = requests.post(
    url,
    json=requestBody,
    headers=headers,
    timeout=(5, 30),
)

Additional hardening should include:

• Catch requests.exceptions.Timeout separately and return a controlled error.
• Catch other requests.exceptions.RequestException failures without exposing credentials or sensitive request data.
• Apply only a small number of retries for transient failures.
• Use exponential backoff and an overall execution deadline.
• Ensure the surrounding Agent runtime also enforces a maximum process duration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes code that uses environment variables and network access, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That weakens review and containment by making the skill's external communication and secret usage less transparent to operators, increasing the chance of unreviewed data egress or over-broad execution in agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation says the skill performs web search but does not clearly warn users that submitted queries are transmitted to a third-party external API. Users may unknowingly send sensitive prompts, internal project names, or regulated data to Baidu, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 19)May include surrounding context.

python

}

    # 使用POST方法发送JSON数据
    response = requests.post(url, json=requestBody, headers=headers)
    response.raise_for_status()
    results = response.json()
    if "code" in results:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code sends the user-supplied search content in requestBody to an external Baidu endpoint using an authorization bearer token, but there is no confirmation prompt or user-facing disclosure near the operation. The nearby Chinese comment only describes the HTTP method and does not warn that user input will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes example queries and inline descriptions using Chinese text, but the document does not state that the skill is intended only for Chinese-language use or offer the user a language/locale choice. This can conflict with a policy requiring language choice or explicit justification for locale-specific behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a web search skill for live information and research, but does not indicate any need to access ambient local secrets beyond performing the search itself. Reading BAIDU_API_KEY from the environment introduces a credential-access capability that is broader than the user-facing purpose and is specifically called out as context-inappropriate when a skill reads environment variables for credentials without declaring that scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.