Security audit

baidu-skill-guard

Security checks for vulnerabilities and agentic risk

Overview

This is a real skill-security checker, but it gives a remote Baidu service and broad mandatory instructions too much control over skill installation decisions.

Install only if you intentionally want skill install and audit requests routed through Baidu's security API. Treat the report as advisory, require your own confirmation before installing even when it says safe, and run directory scans with read-only access limited to the target skill folders.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Global instruction hijacking delegates installation decisions and final output to a remote service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/check.py:594
Finding: Python fallback follows file symlinks while hashing a skill directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The skill is presented as a narrow pre-install guard, but the documented behavior expands into local directory inspection, metadata extraction, hashing, and batch scanning of arbitrary subdirectories. That mismatch can mislead users and reviewers about the true operational scope, reducing informed consent and increasing the chance that the skill is used with broader filesystem access than expected.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger rules are intentionally overbroad and state that false positives are acceptable, causing the skill to intercept loosely related install/download language across any language and paraphrase. This can be abused to force unexpected invocation, disrupt unrelated workflows, or route user actions through a prescribed network/API path without sufficiently narrow scoping.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
-extracts slug from `_meta.json` (fallback to directory name) and version from `SKILL.md` frontmatter, then queries the API with SHA256 fallback.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes behavior that requires filesystem reads and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a capability-transparency gap: operators and policy systems cannot reliably constrain or review what the skill may access, which is risky for a security-sensitive interceptor that inspects local skill directories and calls remote APIs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description advertises broad trigger phrases like install, add, enable, download, scan, check, and audit skill without clear boundaries. While less severe than the detailed trigger section, this still increases the chance of accidental activation and policy ambiguity in orchestration systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger accepts users in any language, but later instructions require displaying the API-provided report exactly as-is, with examples only in Chinese. This means users may interact in another language yet receive forced fixed-locale output without consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 76% confidence
Finding: Referencing npx clawhub install without a pinned version introduces supply-chain risk because the package resolved at execution time may change or be compromised. In a skill that governs installation workflows, normalizing unpinned execution is especially dangerous because users may copy the command verbatim into privileged environments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file requires the agent to copy report_text verbatim, and the provided examples show the report rendered in Chinese. Because the instructions also say "NEVER write your own security report," the skill effectively enforces a fixed output language with no user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code explicitly hard-codes report timestamps to 'UTC+8' and labels this as a forced behavior in a comment. This creates a locale/timezone policy issue because users are not offered a choice and no region-specific justification is provided in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains numerous hard-coded Chinese user-facing strings for errors, reports, labels, and verdicts, such as at L041, L128-L147, L165-L175, L244-L354, and L691-L984. Because the CLI does not offer any language selection or opt-in mechanism, it enforces a specific language/locale policy in natural-language output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.