Baidu Scholar Search Skill 1.1.0

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Baidu Scholar search wrapper, with limited coding and disclosure issues but no evidence of hidden, destructive, or purpose-mismatched behavior.

Before installing, confirm you are comfortable providing a BAIDU_API_KEY and sending your search terms to Baidu Scholar/Qianfan. Prefer a hardened version that URL-encodes query parameters and validates page_number and include_abstract values to avoid malformed or unintended authenticated requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: baidu_scholar_search.sh:15

Finding

Unencoded User Input Allows Query-String Parameter Injection

Content

View full analysis

Vulnerability Details

File Location: baidu_scholar_search.sh, lines 15–32
Vulnerability Type: Query-string parameter injection caused by missing URL encoding and input validation
Risk Level: Medium

Vulnerable Code

bash

# Get search keyword (required)
WD="$1"
if [ -z "$WD" ]; then
    echo '{"error": "Missing search keyword parameter"}'
    exit 1
fi

# Page number (default 0, i.e., first page)
pageNum="${2:-0}"

# Include abstract (default false, not included)
enable_abstract="${3:-false}"

# Send request
curl -s -X GET \
  -H "Authorization: Bearer $BAIDU_API_KEY" \
  -H "X-Appbuilder-From: openclaw" \
  "https://qianfan.baidubce.com/v2/tools/baidu_scholar/search?wd=$WD&pageNum=$pageNum&enable_abstract=$enable_abstract"

Technical Analysis

The script places the user-controlled WD, pageNum, and enable_abstract values directly into an HTTP query string without URL encoding. Shell double-quoting prevents these values from being interpreted as separate shell commands, so this is not shell command injection. It does not, however, prevent reserved URL characters such as &, =, and # from changing the structure or interpretation of the request.

Only the presence of WD is checked. The script does not verify that pageNum is a nonnegative integer or that enable_abstract is one of the documented Boolean values. Consequently, a caller can inject additional query parameters or submit unexpected values to the authenticated Baidu endpoint.

Attack Path

1. An attacker or untrusted caller invokes the skill with a crafted keyword, for example:

   bash

   bash baidu_scholar_search.sh 'topic&enable_abstract=true&extra=value' 0 false
   

2. The script interpolates the value directly into the request URL:

   text

   https://qianfan.baidubce.com/v2/tools/baidu_scholar/search?wd=topic&enable_abstract=true&extra=value&pageNum=0&enable_abstract=false
   

3. The remote API receives attacker-injected parameters und ...[truncated 959 chars]

Remediation

View remediation

Remediation Suggestions

Use curl's native query-parameter encoding rather than constructing the query string through interpolation. Validate parameters against their documented formats before making the request.

A hardened implementation could use:

bash

#!/bin/bash
set -euo pipefail

if [ -z "${BAIDU_API_KEY:-}" ]; then
    echo '{"error": "BAIDU_API_KEY environment variable not set"}'
    exit 1
fi

WD="${1:-}"
if [ -z "$WD" ]; then
    echo '{"error": "Missing search keyword parameter"}'
    exit 1
fi

pageNum="${2:-0}"
enable_abstract="${3:-false}"

if ! [[ "$pageNum" =~ ^[0-9]+$ ]]; then
    echo '{"error": "page_number must be a nonnegative integer"}'
    exit 1
fi

if [[ "$enable_abstract" != "true" && "$enable_abstract" != "false" ]]; then
    echo '{"error": "include_abstract must be true or false"}'
    exit 1
fi

curl -sS --fail-with-body --get \
  -H "Authorization: Bearer $BAIDU_API_KEY" \
  -H "X-Appbuilder-From: openclaw" \
  --data-urlencode "wd=$WD" \
  --data-urlencode "pageNum=$pageNum" \
  --data-urlencode "enable_abstract=$enable_abstract" \
  "https://qianfan.baidubce.com/v2/tools/baidu_scholar/search"

This approach ensures that reserved characters in the search term are treated as data rather than query-string delimiters. It also restricts the other arguments to their documented types. Keep the destination origin fixed, continue using HTTPS, and avoid printing the authorization header or API key in diagnostic output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes shell execution via documented bash commands and metadata requiring the curl binary, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where an agent or runtime may permit broader command execution than intended, increasing the risk of command misuse or abuse if user-controlled input reaches the shell wrapper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This shell script sends the user-provided search keyword to an external Baidu endpoint and includes an authorization bearer token, but the script provides no runtime notice, confirmation, or explicit warning about the outbound data transmission. The header comments describe usage only and do not disclose that query data and credentials are sent to a third-party service.

Content

No source excerpt is available for this finding.