Bailian Web Search

• Analyzed: May 12, 2026, 4:21 AM
• Findings: 1
• Version: 1.0.4
• Hash: 20274faade29fe67856fc057414d0afea346317dd666f5f990214906658620d5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides an AI-optimized web search via the Bailian (Alibaba ModelStdio) API. The `scripts/mcp-websearch.sh` script correctly validates numerical input for `count` and uses `jq --arg` to safely embed user-provided `query` into JSON payloads, preventing both shell and JSON injection vulnerabilities. It uses the `DASHSCOPE_API_KEY` as intended for authentication with the legitimate `dashscope.aliyuncs.com` endpoint. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md`.