ClawHub
Back to skill

Security audit

Baidu

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Baidu research and planning helper with local notes and approval gates for account-changing actions.

Install only if you are comfortable with Baidu-related queries being sent to Baidu services and with local Baidu workflow notes being kept under ~/baidu. Do not provide secrets in chat; account-level actions should remain explicit and manually approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
- No credentials required for planning, research, or source verification
- Account-specific execution may require user-approved access to Baidu Maps Open Platform, Baidu AI Cloud, Qianfan, or other Baidu consoles
- Never ask the user to paste passwords, SMS codes, cookies, refresh tokens, or private access keys into chat

## Data Storage

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · mainland-vs-global.md (reported line 27)May include surrounding context.

md
- Using English summaries as if they are the freshest source
- Assuming search ranking means the same thing for all geographies
- Recommending Qianfan or Maps steps without checking where the team operates
- Mixing public-web research with cloud rollout constraints

## Output Contract

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · search-knowledge.md (reported line 38)May include surrounding context.

md
- Using English summaries as if they are the freshest source
- Assuming search ranking means the same thing for all geographies
- Recommending Qianfan or Maps steps without checking where the team operates
- Mixing public-web research with cloud rollout constraints

## Output Contract

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The template includes fields for 'Preferred docs language' and 'Chinese-first sources allowed' in a Baidu-specific memory file, which may steer the skill toward a fixed language/locale behavior. Because the file does not explicitly say this is user-chosen or optional at the point of use, it risks creating a default language policy without clear user opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 43)May include surrounding context.

bash
mkdir -p ~/baidu
touch ~/baidu/{memory.md,accounts.md,regions.md,sources.md,decisions.md}
chmod 700 ~/baidu
chmod 600 ~/baidu/{memory.md,accounts.md,regions.md,sources.md,decisions.md}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 44)May include surrounding context.

mkdir -p ~/baidu touch ~/baidu/{memory.md,accounts.md,regions.md,sources.md,decisions.md} chmod 700 ~/baidu chmod 600 ~/baidu/{memory.md,accounts.md,regions.md,sources.md,decisions.md}

text

If `~/baidu/memory.md` is empty, initialize the baseline files from `memory-template.md`.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The routing question on L20 frames the decision around mainland China, Chinese-language research, or broader global workflow, but the document does not explicitly state that language/locale should be user-selected or optional. This can be read as imposing locale assumptions rather than prompting for user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The 'Language preference' field under region defaults could be used to impose a locale preference as part of default behavior. Since the template does not explicitly state that this preference must come from user choice or a documented regional requirement, it may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Line L26 instructs the user to search again with the original Chinese term if available, which nudges the workflow toward a specific language/locale. The file does not explicitly offer a language choice or explain that this locale-specific behavior is optional or limited to Chinese-source cases by policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.