百度AI搜索（千帆）
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill mostly does what it claims (calls Baidu 千帆 API) but its metadata omits required environment variables and dependency information, which is an important mismatch you should resolve before installing.
This skill appears to implement the claimed Baidu 千帆 AI search and only contacts the Baidu endpoint, but there are two practical issues you should address before installing: (1) the skill requires a BAIDU_API_KEY (it reads this from the environment), yet the registry metadata does not declare this—treat this key as a secret and only provide one scoped appropriately; (2) the bundled Python script depends on the 'requests' library but no dependency or install instructions are provided. Ask the publisher to update the metadata to declare BAIDU_API_KEY and to list dependencies or provide an install step. If you don't trust the unknown source, avoid providing your API key. Finally, verify the endpoint and quota implications and consider running the script in an isolated environment (e.g., container) if you choose to test it.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.