Chinese Search Enhancement

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:35 AM UTC
• Version: 1.0.0

Overview

This paid Chinese search skill performs the advertised searches, but it under-discloses local identity collection, an extra Baidu proxy, and a bundled billing API key.

Review before installing. Treat searches as non-private: queries leave the machine, including via an unlisted Baidu proxy. Billing also sends a stable local identifier to SkillPay despite the anonymous/no-local-files documentation, and the publisher should rotate the exposed API key and update the disclosure before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: search.mjs:13

Finding

Stable OpenClaw or Host Identity Is Collected and Transmitted to SkillPay

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: lib/billing.mjs:1

Finding

Reusable SkillPay API Credential Is Hard-Coded in Distributed Source Code

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: lib/baidu.mjs:6

Finding

Baidu Search Queries Are Sent to an Undisclosed Third-Party Proxy

Content

View full analysis

({ title: item.title || "", snippet: item.desc || item.description || "", url: item.url || item.link || "", source: "baidu", })); } catch { return null; } } ``` ```js export async function searchBaidu(query, limit = 5) { const apiResults = await searchViaFreeApi(query, limit); if (apiResults && apiResults.length > 0) { return apiResults; } return searchViaScrape(query, limit); } ``` The documentation states: ```md - **External endpoints accessed**: Baidu (baidu.com), Sogou (sogou.com, weixin.sogou.com), Zhihu (zhihu.com), SkillPay (skillpay.me) - **Local files**: None read or written - **Data handling**: Search queries are sent to the above search engines. No user data is stored. Billing is processed via SkillPay with anonymous caller IDs. ``` ### Technical Analysis For every Baidu search, the implementation first sends the complete query to `v.api.aa1.cn`. Direct access to Baidu is only used if the proxy request fails or returns no results. The proxy domain is not listed in the Skill's security and privacy disclosure. Users are therefore not informed that their search terms are provided to this additional party. Search queries may contain confidential project ...[truncated 1841 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Known Vulnerable Dependency: undici==7.22.0 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile pins transitive dependency undici to 7.22.0, and the supplied advisory set indicates known high-severity issues including request/response smuggling, response queue poisoning, and CRLF injection. Because this skill performs web search/scraping against remote sites, it likely makes outbound HTTP requests in normal operation, so a vulnerable HTTP client library increases exposure to malicious or malformed upstream responses and header manipulation attacks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill 'Returns AI-optimized structured results in Chinese,' which imposes a specific language behavior. Under the policy criteria, forcing a language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The implementation sends user search queries to an unrelated third-party endpoint (v.api.aa1.cn) before falling back to Baidu scraping, which materially differs from the advertised behavior of a Baidu search helper. This creates an undisclosed data-sharing path to an untrusted service that can log, profile, or manipulate results, especially dangerous because search queries often contain sensitive personal, commercial, or investigative terms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code transmits raw user queries to a third-party free API without any visible disclosure, consent, or trust boundary indication. Because the service is unrelated to the stated providers and appears free/unvetted, it introduces significant privacy and integrity risk through possible logging, resale, surveillance, or tampering with returned results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The scraping fallback sends the user query to www.baidu.com over the network, which transmits user-provided data to an external service. This file does not include any confirmation prompt, user-facing logging, or explanatory comments/docstrings warning about that transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The charge function sends a user ID, skill ID, and billing amount to an external billing service, but the code provides no confirmation prompt, user-visible logging, or explanatory comment/docstring disclosing this behavior. For code files, outbound transmission of user or system data should be accompanied by some visible warning unless the disclosure exists elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The getPaymentLink function posts the user ID and requested amount to an external billing API, but the code includes no confirmation, user-visible output, or documentation warning about this external transmission. Because it affects payment workflow and transmits user-linked billing data, some disclosure is expected in code or accompanying skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

User-supplied search queries are sent to third-party search providers, which can expose sensitive user interests, prompts, or identifiers to external services. In a paid search skill, users may reasonably assume the provider handles the query, so undisclosed transmission increases privacy risk and can violate user expectations or policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function sends the user's raw search query to Sogou, including an added site filter for Zhihu, without any indication in the code that the user is informed or has consented to third-party disclosure. Search queries often contain sensitive personal, commercial, or investigative information, so transmitting them to external providers creates a privacy leak and data-sharing risk even if the network transport itself is HTTPS.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The fallback path transmits the user's query directly to Zhihu when Sogou parsing yields no results, again without any visible disclosure or consent mechanism in the code. Because this is an automatic fallback, users may not even realize an additional third party receives their query, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill derives a billing identifier by reading local identity files and, failing that, falls back to host and username data. That is broader than necessary for a search feature and exposes local system identity information to an external billing path, creating unnecessary privacy leakage and cross-context tracking risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill searches Baidu, Zhihu, and WeChat and notes it is a paid skill, but the code actively performs charging, balance checks, and payment-link generation before search execution. This is behavior beyond returning search results and is not captured in the functional description of the skill itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code sends a caller identifier to the external billing function before performing the search, without any in-file notice or consent flow. If the identifier is derived from local identity files or host/user information, this can expose sensitive metadata to a third party and enable user/device tracking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill forwards the user-provided query to external search functions for Baidu, Zhihu, and WeChat. Although remote search is part of the tool's purpose, this file does not include any user-facing disclosure that entered queries will be sent to third-party services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Accept-Language header is hard-coded to zh-CN/zh, which enforces a specific locale for requests. There is no indication in this file that the user can opt into this locale or that the constraint is documented as region-specific and intentional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The getBalance function transmits the user ID in a network request to a remote billing endpoint, but there is no visible notice, confirmation, log, or inline documentation warning about this data transfer. This matches the missing-warning criterion for network calls that transmit user or system data in code files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a Chinese search enhancement for WeChat articles, which implies searching WeChat content sources. In this file, both the primary path and fallback path fetch HTML from Sogou-operated endpoints (weixin.sogou.com and www.sogou.com) and scrape those result pages, so the implemented behavior relies on third-party search scraping rather than directly searching WeChat articles.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The request explicitly sets Accept-Language to zh-CN,zh;q=0.9, which imposes a specific language/locale preference. The file does not indicate that this is optional, user-selected, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The fallback fetch repeats the hard-coded Accept-Language value zh-CN,zh;q=0.9. This is a natural-language locale policy issue because the code enforces a specific language preference without presenting a choice or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request explicitly sets Accept-Language to zh-CN,zh;q=0.9, which imposes a specific language/locale on the interaction. There is no indication in this file that the user can opt in to this locale choice or that the constraint is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This second network request repeats the hard-coded Accept-Language header for Chinese, again enforcing a locale choice in the skill's behavior. Without user selection or justification, this conflicts with the policy against forcing a specific language or locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states the skill is a "Chinese search enhancement" and specifically targets Chinese platforms, which indicates a fixed language/locale scope. There is no visible opt-in, user choice, or justification in this file for restricting behavior to Chinese-language sources.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Using a caret range for cheerio allows automatic installation of newer compatible versions, which can introduce supply-chain risk if a future release contains a vulnerability or malicious code. While this file alone does not prove compromise, dependency drift reduces build reproducibility and weakens control over what code is executed.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "Chinese search enhancement for AI agents - Baidu, Zhihu, WeChat articles",
  "type": "module",
  "dependencies": {
    "cheerio": "^1.0.0",
    "commander": "^14.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Using a caret range for commander permits unreviewed newer releases within the semver range to be installed, increasing exposure to supply-chain attacks or accidental introduction of vulnerable code. This is a common hygiene weakness rather than evidence of malicious intent, but it still expands risk.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json

"type": "module",
  "dependencies": {
    "cheerio": "^1.0.0",
    "commander": "^14.0.0"
  }
}