Baidu Hot Real

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:56 PM UTC
• Version: 1.3.0

Overview

The skill mostly matches its Baidu hot-search purpose, but its npm metadata pulls an unnecessary third-party package during installation that users should review first.

Review the package before installing with npm. The runtime behavior is limited to fetching public Baidu trend data, but the package should remove the npm python3 dependency and document Python 3 as a local prerequisite instead.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:12

Finding

Unnecessary npm Dependency Introduces Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: package.json, lines 12–14
Vulnerability Type: Unnecessary third-party package dependency
Risk Level: Medium

json

"dependencies": {
  "python3": ">=3.6"
}

Technical Analysis

The dependencies field instructs npm to install a registry package named python3. It does not declare or enforce the presence of the system Python interpreter.

The project only invokes the local python3 executable and does not import or otherwise use an npm module named python3. This dependency is therefore unnecessary and expands the project's software supply-chain attack surface. During npm installation, package contents and applicable lifecycle scripts belonging to the registry dependency or its transitive dependencies may execute with the privileges of the user or automation account running npm.

Attack Path

1. A user, CI worker, or deployment process installs the project using npm.
2. npm interprets python3 as the name of a package to retrieve from the configured npm registry.
3. npm resolves and installs an eligible python3 package release and any transitive dependencies.
4. Package lifecycle scripts, if present and permitted by the npm configuration, execute under the installer account.
5. If the package, a transitive dependency, a maintainer account, or the configured registry is compromised, attacker-controlled code can execute on the installation host.

Impact Assessment

Successful exploitation could execute code with the privileges of the account performing the npm installation. Depending on the installation environment, this could expose workspace files, environment variables, CI credentials, package-publishing tokens, and other resources available to that account.

The issue does not independently provide privilege escalation. Its scope is limited by the installer account's existing permissions and by npm settings such as lifecycle-script restriction ...[truncated 144 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the python3 entry from dependencies:

   json

   {
     "name": "baidu-hot-real",
     "version": "1.3.0",
     "description": "Baidu real-time trending-list fetcher",
     "main": "scripts/fetch.sh",
     "scripts": {
       "fetch": "bash scripts/fetch.sh",
       "test": "python3 scripts/baidu_fetch.py 10"
     },
     "license": "MIT"
   }
   

2. Document Python 3 as an operating-system runtime prerequisite rather than an npm dependency.
3. Add a runtime check such as command -v python3 >/dev/null 2>&1 before invoking Python and return a clear error if it is unavailable.
4. If npm dependencies are introduced later, use a committed lockfile, pinned and reviewed versions, trusted registries, automated dependency scanning, and restricted lifecycle-script execution.
5. In CI and other sensitive environments, consider installing with lifecycle scripts disabled when package functionality does not require them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims to directly fetch real-time Baidu hot search data from the official site, but the finding indicates that direct retrieval is not actually implemented and that the skill may instead rely on externally supplied HTML and heuristic parsing. This can mislead users about data provenance and trustworthiness, and could allow manipulated or stale content to be treated as official live data.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The script performs outbound network access via urllib.request.urlopen, but the static finding indicates this capability is not declared in the skill's permissions. Even though the target URL is hardcoded to Baidu and the code includes a simple domain check, undeclared network access expands the runtime trust boundary and can violate platform security expectations or enable unintended external communication if the code is later modified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 53)May include surrounding context.

md

本技能**不执行**以下操作：
- ❌ 读取 ~/.ssh、.env、credentials 等敏感文件
- ❌ 访问系统配置文件（/etc/*）
- ❌ 执行 sudo 或提权操作
- ❌ 创建/修改用户账户
- ❌ 网络监听或反弹 shell
- ❌ 数据外发到非百度域名

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content and examples are presented only in Chinese, which can amount to a language policy violation when no user opt-in or alternative language is offered. The file does not state that the skill is intended only for Chinese-speaking users or provide any language-selection mechanism.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/fetch.sh (reported line 42)May include surrounding context.

sh

# 验证临时文件权限（应该是 600）
PERM=$(stat -c %a "$TEMP_FILE" 2>/dev/null || stat -f %Lp "$TEMP_FILE" 2>/dev/null)
if [ "$PERM" != "600" ] && [ "$PERM" != "644" ]; then
    chmod 600 "$TEMP_FILE"
fi

# 处理数据

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill documentation is presented in Chinese, and there is no indication that users can choose another language or that the locale restriction is intentional and documented as region-specific. Under the policy for natural-language violations, forcing a specific language without user opt-in should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The package description is entirely in Chinese and presents the skill as Chinese-specific without indicating any user language choice or explaining a required locale constraint. Under the language/locale policy rule, this can be considered a natural-language policy issue because it implicitly forces a specific language experience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file's natural-language comments and user-facing messages are written entirely in Chinese, including status and error output, without indicating that language choice is configurable or intentionally limited to a Chinese-only audience. This can violate a language/locale policy where skills should not force a specific language without user opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.