Baidu Top - 百度热搜榜单

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:28 AM UTC
• Version: 1.0.1

Overview

This skill fetches public Baidu ranking pages and prints them, with no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, be aware that the skill contacts Baidu to fetch public rankings and asks you to install Python packages from pip. For stricter environments, install dependencies in a virtual environment and consider pinning package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:18

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–20
Vulnerability Type: Unpinned runtime dependencies without integrity verification
Risk Level: Low

bash

pip install requests beautifulsoup4

Technical Analysis

The documented installation command retrieves the latest available versions of requests, beautifulsoup4, and their transitive dependencies from pip's configured package index. It does not specify reviewed versions, enforce package hashes, or use a lock file.

Consequently, installation is not reproducible and trusts mutable package-index state. If a package release, maintainer account, configured index, or transitive dependency is compromised, pip could install attacker-controlled code. Python packages may execute build or installation logic during installation, and the installed packages are subsequently imported by get.py.

This finding concerns supply-chain hardening. The reviewed project does not itself specify a malicious package, typo-squatted name, or untrusted index.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, a package-maintainer account, or the package index configured in the user's environment.
2. The attacker publishes or serves a malicious version under a dependency name resolved by the documented command.
3. A user follows the documentation and runs:

   bash

   pip install requests beautifulsoup4
   

4. Because versions and hashes are not constrained, pip resolves and installs the malicious or otherwise unreviewed release.
5. Attacker-controlled package code may run during installation or when get.py imports the dependency.

Impact Assessment

Successful exploitation could execute code with the privileges of the user performing installation or running the Skill. Within those privileges, an attacker could access user-readable data, modify user-writable files, steal environment credentials, alter Skill output, or establish addition ...[truncated 247 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency lock file that pins direct and transitive dependencies to exact versions.
2. Record cryptographic hashes for every distributable artifact and require verification during installation:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate the locked requirements from a trusted environment and review dependency changes before updating it.
4. Install dependencies inside an isolated virtual environment rather than into the system Python environment.
5. Use only an explicitly trusted package index and avoid fallback to untrusted or uncontrolled indexes.
6. Add automated dependency vulnerability and provenance scanning to the release process.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires network access to fetch Baidu rankings, but the manifest does not explicitly declare tool scope or permissions. This creates a capability-transparency gap: a host may invoke the skill without users or policy layers clearly understanding that outbound network access is required, which weakens least-privilege controls and auditing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation text includes broad examples and 'or similar' phrasing without clear boundaries, which can cause the agent to over-trigger the skill on loosely related requests. Over-broad activation increases the chance of unintended network calls, data retrieval from third-party sites, and incorrect tool selection in contexts the user did not explicitly intend.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.