百度搜索中文版

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:19 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Baidu search proxy, but it needs review because some run paths can expose an unauthenticated service backed by your Baidu API key and it logs submitted search content.

Install only if you are comfortable running a local Baidu-backed search proxy. Keep it bound to 127.0.0.1, do not expose port 8001 publicly, protect the BAIDU_API_KEY, avoid committing .env, and treat logs as potentially containing search queries and request content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/baidu_search/main.py:44

Finding

Unauthenticated Search Proxy Can Expose the Operator's Baidu API Quota

Content

View full analysis

SearchResponse: """ 搜索网页 - **query**: 搜索关键词 - **top_k**: 返回结果数量 (1-20, 默认 10) - **recency_filter**: 时间过滤 (day, week, month, year) - **site_filter**: 限定搜索的网站列表 """ return search(request) if __name__ == "__main__": import uvicorn uvicorn.run("baidu_search.main:app", host="0.0.0.0", port=8001) ``` ### Technical Analysis The `/search` endpoint has no authentication, authorization, rate limiting, or usage controls. When the module is executed directly, Uvicorn binds to `0.0.0.0`, making the endpoint reachable through every available network interface unless external firewall rules prevent access. Every accepted request is forwarded to Baidu using the server-side `BAIDU_API_KEY`. Consequently, any client able to reach the service can consume the operator's Baidu API quota without possessing the key. This creates a confused-deputy condition in which the application exercises the operator's provider privileges on behalf of arbitrary callers. Although the documented startup command binds to `127.0.0.1`, the direct-execution configuration is independently unsafe and can result in accidental network exposure. ### Attack Path 1. An operator launches the application directly with `python -m baidu_search.main` or otherwise executes `main.py`. 2. The application listens on `0.0.0.0:8001`. 3. An attacker discovers the reachable service through network scanning or deployment metadata. 4. The attacker repeatedly sends valid POST requests to `/search`. 5. The service authenticates each upstream request with the operator's `BAIDU_API_KEY`. 6. The attacker consumes the operator's quota, incurs provider costs, or exhausts service capa ...[truncated 445 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search/baidu_api.py:106

Finding

Search Queries Are Recorded in Application Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search/main.py:27

Finding

Validation Failures Log Complete Attacker-Controlled Request Bodies

Content

View full analysis

JSONResponse: logger.error( "Validation error on %s %s. body=%s errors=%s", request.method, request.url.path, exc.body, exc.errors(), ) return JSONResponse( status_code=422, content=jsonable_encoder({"detail": exc.errors()}), ) ``` ### Technical Analysis The validation exception handler logs `exc.body`, which can contain the complete request body supplied by an unauthenticated caller. This data may contain confidential information or deliberately injected log content. Because validation failures can be generated at will, an attacker can cause arbitrary request values to be retained at the error logging level. Error logs are generally retained and alerted on more aggressively than informational logs. Repeated malformed requests can also produce excessive log volume, consuming storage and obscuring legitimate security events. ### Attack Path 1. An attacker or user sends a request that intentionally fails schema validation. 2. The submitted body includes sensitive data, misleading log text, or a large volume of attacker-controlled content. 3. FastAPI raises `RequestValidationError`. 4. The custom handler writes `exc.body` and validation details to the error log. 5. The content persists in local or centralized logging systems; repeated requests can increase storage consumption and monitoring noise. 6. Anyone with log access can subsequently retrieve the recorded body. ### Impact Assessment The primary impact is disclosure of arbitrary request content through logs. A remote unauthenticated attacker can also genera ...[truncated 263 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search/baidu_api.py:124

Finding

Raw Baidu Error Responses Are Logged and Disclosed to API Clients

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

bash

cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares capabilities that require environment variable access and outbound network use, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens containment and reviewability because users and orchestrators cannot easily determine what the skill is authorized to access before installation or execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Quick Start

1. 检查服务: curl http://127.0.0.1:8001/ping

2. 搜索网页:

bash

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file's natural-language strings in comments and docstrings are exclusively in Chinese, including user-facing or maintainer-facing descriptions such as the function docstrings. Under the stated policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The setup instructions tell users to write the API key directly into a local .env file without any warning about secret storage, file permissions, or accidental commit risk. While common, this can lead to credential exposure through source control, shell history, backups, or shared directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is written only in Chinese ("百度 AI 搜索 API 代理服务"), which implies a fixed language/locale presentation without any stated opt-in or explanation. Under the policy rule, locale constraints should either offer user choice or be clearly documented as intentionally region-specific.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The only natural-language description in this file is the Chinese docstring "百度搜索 API 代理服务", which fixes the skill description to a specific language without any opt-in or alternative locale. The policy requires flagging language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The API title and description are presented only in Chinese, which imposes a specific language in user-facing metadata without any opt-in or documented locale constraint. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.