Baidu Search For Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This Baidu search skill does what it claims, but its web-fetching helper has unsafe network defaults that could expose internal services or accept tampered HTTPS content.

Install only if you are comfortable with a tool that sends queries to Baidu and fetches external webpages from your agent environment. Avoid using it for sensitive internal URLs or confidential queries, and consider fixing URL validation, TLS verification, pinned dependencies, and the sys.path import before use in a trusted workspace.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fetch_url.py:39

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_url.py, lines 39–58
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: High

Vulnerable Code

python

def fetch_url(url, max_chars=None, timeout=30):
    """
    Fetch and parse web content.

    Args:
        url: Web page URL
        max_chars: Maximum number of returned characters
        timeout: Request timeout
    """
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
    }

    try:
        response = requests.get(url, headers=headers, timeout=timeout, verify=False)

Technical Analysis

The fetch_url function passes a caller-controlled URL directly to requests.get without validating its scheme, hostname, resolved IP address, destination port, or redirect targets.

The Requests library follows redirects by default. Consequently, validating only an initial URL would also be insufficient: an external server could redirect the request to a loopback, private, link-local, reserved, or cloud metadata address.

This creates an SSRF primitive in any environment where an untrusted party can provide a URL directly or influence a search result processed by search_and_fetch.py.

Attack Path

1. An attacker provides a URL to scripts/fetch_url.py, or causes a malicious URL to appear in search results processed by scripts/search_and_fetch.py.
2. The URL references an internal destination directly, such as a loopback/private address, or references an external server that redirects to one.
3. requests.get sends the request from the Agent host without destination validation.
4. The response is parsed and returned through the script's text or JSON output.
5. The attacker may use the returned content to enumerate internal services or obtain information from resources unavailable from the public network.

...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only explicitly supported schemes, normally https and, if necessary, http.
• Reject URLs containing embedded credentials, malformed hostnames, unsupported ports, or ambiguous IP representations.
• Resolve the hostname before connecting and reject loopback, private, link-local, multicast, reserved, unspecified, and metadata-service addresses for both IPv4 and IPv6.
• Disable automatic redirects or validate and resolve every redirect destination before following it.
• Protect against DNS rebinding by ensuring the validated address is the address used for the connection.
• Prefer an explicit domain allowlist when the expected destinations are known.
• Route outbound traffic through a controlled proxy or firewall that blocks internal address ranges.
• Apply response-size and streaming limits to prevent excessive memory consumption while retrieving untrusted resources.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch_url.py:56

Finding

TLS Certificate Verification Is Explicitly Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_url.py, lines 56–58
Vulnerability Type: Improper Certificate Validation
Risk Level: High

Vulnerable Code

python

try:
    # SSL verification is disabled for compatibility with some environments.
    response = requests.get(url, headers=headers, timeout=timeout, verify=False)

Technical Analysis

Passing verify=False disables HTTPS certificate-chain and hostname verification for every request. Although traffic remains encrypted, the remote server is not authenticated.

An attacker capable of intercepting or redirecting network traffic can therefore present an arbitrary certificate and impersonate the requested website. Because retrieved page text is subsequently displayed or incorporated into search-processing output, forged content may also become untrusted input to an Agent workflow.

Attack Path

1. A user or automated workflow requests an HTTPS resource through fetch_url.
2. An attacker positioned on the network, controlling DNS, or controlling an upstream proxy intercepts the connection.
3. The attacker presents an invalid, self-signed, expired, or hostname-mismatched certificate.
4. The request succeeds because certificate verification is disabled.
5. The attacker returns manipulated page content or redirects the client to another attacker-selected destination.
6. The forged content is parsed and exposed through the script output.

Impact Assessment

A successful attack compromises the confidentiality and integrity of fetched HTTPS content. The attacker may:

• Read URLs and response traffic passing through the intercepted connection
• Substitute false search-result content
• Inject misleading or adversarial text into downstream Agent context
• Influence redirect behavior
• Collect information included in future request headers or URLs

This flaw does not directly execute remote code, but it removes a fundamen ...[truncated 66 chars]

Remediation

View remediation

Remediation Suggestions

• Remove verify=False and use Requests' default certificate verification.

• If the environment uses a private certificate authority, configure an explicit trusted CA bundle:

  python

  response = requests.get(
      url,
      headers=headers,
      timeout=timeout,
      verify="/path/to/approved-ca-bundle.pem",
  )
  

• Do not globally suppress insecure-request warnings as a substitute for certificate validation.

• Keep the operating system or application CA bundle current.

• Consider enforcing HTTPS for destinations that support it.

• Add tests confirming that self-signed, expired, and hostname-mismatched certificates are rejected.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/search_and_fetch.py:25

Finding

Current-Directory Import Precedence Enables Local Module Hijacking

Content

View full analysis

Vulnerability Details

File Location: scripts/search_and_fetch.py, lines 25–27
Vulnerability Type: Python Module Search-Path Hijacking
Risk Level: High

Vulnerable Code

python

# Import the fetch_url function.
sys.path.insert(0, '.')
from fetch_url import fetch_url

Technical Analysis

The script inserts the current working directory at the beginning of sys.path and then imports fetch_url. The current working directory is determined by where the process is launched, not by the trusted location of search_and_fetch.py.

If the process starts in a directory containing an attacker-controlled fetch_url.py, Python selects that file before the bundled implementation. Importing a Python module executes its top-level statements, allowing arbitrary code execution before normal script processing begins.

Attack Path

1. An attacker obtains write access to a directory from which a user or automation system may launch the script.
2. The attacker places a malicious file named fetch_url.py in that directory.
3. The victim launches scripts/search_and_fetch.py while the attacker-controlled directory is the current working directory.
4. sys.path.insert(0, '.') gives that directory the highest import priority.
5. Python imports and executes the attacker's module.
6. The malicious module may then export a plausible fetch_url function so the script appears to continue operating normally.

Impact Assessment

The attacker obtains arbitrary Python code execution with the same operating-system identity and permissions as the Agent process. This may allow access to:

• Files readable or writable by the Agent account
• Environment variables and process credentials
• Network resources available to the Agent host
• Outputs and search queries handled by the script
• Any external systems accessible through credentials already available to the process

The vulnerability does not itself ...[truncated 155 chars]

Remediation

View remediation

Remediation Suggestions

• Package the scripts as a Python package and use an explicit package-relative import:

  python

  from .fetch_url import fetch_url
  

• When direct script execution must be supported, resolve the trusted module relative to __file__, not the current working directory.

• Do not prepend . or another attacker-influenced directory to sys.path.

• Launch the application from a controlled, non-writable installation directory.

• Ensure deployment directories and Python module paths are not writable by untrusted users.

• Add an automated test that launches the script from a directory containing a fake fetch_url.py and verifies that the bundled module is used.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–85
Vulnerability Type: Unpinned and Unverified Dependencies
Risk Level: Medium

Vulnerable Code

bash

pip3 install --user baidusearch requests beautifulsoup4 lxml

Technical Analysis

The installation instructions retrieve packages without exact version constraints, integrity hashes, a lockfile, or an explicitly approved package index. As a result, the installed code can change over time even when the Skill package itself remains unchanged.

Python package installation may execute package-controlled build logic. Runtime imports also execute package initialization code. A compromised upstream release, package-index compromise, unsafe configured index, or malicious transitive dependency could therefore introduce code that was not present during this audit.

The audit found no evidence that the named packages are intentionally malicious. The confirmed issue is the absence of controls that make dependency resolution reproducible and verifiable.

Attack Path

1. A user follows the documented installation command.
2. pip resolves the latest package versions and transitive dependencies from its configured index.
3. An upstream account, package release, configured index, or transitive dependency has been compromised.
4. The installer downloads the affected package without checking a project-provided expected hash.
5. Malicious build or package code executes during installation or when the Skill imports the dependency.

Impact Assessment

Successful supply-chain compromise can execute arbitrary code with the permissions of the user performing installation or running the Skill. Potential exposure includes user files, environment variables, application credentials, and network resources available to that account.

The documented --user option limits installation to the current user's package area, but it does not sandbox package instal ...[truncated 28 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version.
• Generate and commit a lockfile that records transitive dependencies.
• Require cryptographic hashes during installation, for example through a reviewed requirements file and pip install --require-hashes.
• Use an approved, explicitly configured package index or internal artifact repository.
• Scan direct and transitive dependencies for known vulnerabilities before release.
• Use isolated virtual environments rather than modifying the user's general package environment.
• Establish a controlled dependency-update process that reviews release provenance and security changes before updating pins.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are overly broad for a search-specific skill, so the agent may invoke this capability for generic requests about fetching or parsing webpages that were not intended for Baidu search. That can cause unnecessary outbound requests to Baidu or third-party sites, increasing the chance of unintended data disclosure, policy bypass, or unsafe web retrieval in contexts where a narrower tool should have been selected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs outbound network requests to Baidu and arbitrary third-party webpages but does not clearly warn that user queries and accessed URLs will be transmitted externally. This creates a privacy and compliance risk because sensitive prompts, internal research topics, or tracked URLs could be sent off-platform without informed user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language usage instructions entirely in Chinese, and the same single-language pattern continues in prompts and errors elsewhere in the script. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation unless the tool is clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Disabling TLS certificate verification with verify=False makes HTTPS connections vulnerable to man-in-the-middle attacks, allowing an attacker to intercept or modify fetched content. In this skill's context, the script fetches arbitrary user-supplied URLs and then parses and outputs the response, so trusting unauthenticated network data significantly increases the risk of tampered content being consumed downstream.

Content

Scanner excerpt · scripts/fetch_url.py (reported line 54)May include surrounding context.

python

try:
        # 禁用 SSL 验证（某些环境可能需要）
        response = requests.get(url, headers=headers, timeout=timeout, verify=False)
        response.raise_for_status()
        response.encoding = response.apparent_encoding

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring, argument descriptions, status messages, and errors are all presented only in Chinese. This creates a language/locale policy concern because the skill forces a specific language experience without user opt-in or an explicit statement that the tool is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and command-line help text are written only in Chinese, and the script's runtime messages also appear in Chinese. This imposes a specific language on users without an opt-in or alternate locale path, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/fetch_url.py:54