baidu-aistudio-llm-api

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:11 AM UTC
• Version: 1.0.3

Overview

This is a coherent Baidu AI Studio API helper, but it needs Review because its setup guidance can expose the user's API token and installs an unpinned dependency.

Review before installing. Use a virtual environment, pin the `openai` package version if possible, do not run `echo $AI_STUDIO_API_KEY`, and treat all prompts, files, image URLs, search queries, and embeddings input as data sent to Baidu AI Studio services under that provider's policies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Runtime Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:47` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Vulnerable Code:** ```bash pip install openai ``` ### Technical Analysis The setup instructions install the latest available `openai` package without a version constraint, lock file, or cryptographic hash verification. Consequently, the dependency resolved when a user installs the Skill may differ from the version that was reviewed. Although no malicious dependency is currently demonstrated, this mutable installation process creates a supply-chain exposure. A compromised package release, package-index account, or unexpectedly unsafe future version could introduce arbitrary code that runs during installation or when the scripts import `OpenAI`. ### Attack Path 1. An attacker compromises the upstream package distribution process or publishes a malicious release through a compromised maintainer account. 2. A user follows the documented `pip install openai` instruction after that release becomes the latest version. 3. The package manager downloads and installs the altered package without validating a reviewed version or expected hash. 4. Malicious package code executes during installation or when `scripts/test_connection.py` or `scripts/list_models.py` imports the package. 5. The code operates with the privileges of the user running the installation or script. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending on that user's access, the malicious dependency could read environment variables such as `AI_STUDIO_API_KEY`, access user-readable files, make network requests, alter local files, or consume API quota. The scope is limited by the privileges and isolation controls applied to the Python environment.
• Remediation: ## Remediation Suggestions - Pin `openai` to a specifically reviewed version rather than installing the mutable latest release. - Maintain dependencies in a lock file generated through a controlled review process. - Require verified package hashes during installation, such as with `pip install --require-hashes -r requirements.txt`. - Review and deliberately update the pinned version on a defined schedule. - Install dependencies inside an isolated virtual environment or container with minimal filesystem and credential access. - Use a trusted package index and monitor dependency advisories and package ownership changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26
• Finding: API Token Disclosure Through Terminal Output## Vulnerability Details **File Location**: `SKILL.md:26` **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium **Vulnerable Code:** ```bash echo $AI_STUDIO_API_KEY ``` ### Technical Analysis The documented check prints the complete API token to standard output. The command only needs to determine whether the environment variable is configured, but it exposes the token value itself. Standard output may be retained in terminal scrollback, shell-session recordings, CI logs, remote support transcripts, Agent tool output, screen captures, or shared terminal sessions. Quoting the variable would not address the disclosure because the underlying problem is printing the secret rather than checking its presence. ### Attack Path 1. A user exports a valid `AI_STUDIO_API_KEY`. 2. The user follows the documented command to verify the configuration. 3. The complete token is printed to the terminal. 4. Terminal output is recorded, logged, shared, observed, or otherwise accessed by an unauthorized party. 5. That party copies the token and submits authenticated requests to the Baidu AI Studio API. 6. The token remains usable until it expires or is revoked. ### Impact Assessment An attacker who obtains the token could authenticate within the permissions assigned to that credential, invoke available models, consume the associated quota, and potentially access other API functionality authorized for the account. This finding does not grant local privilege escalation; its scope is bounded by the leaked token's server-side permissions, validity period, rate limits, and account controls.
• Remediation: ## Remediation Suggestions - Replace the command with a presence check that does not reveal the value: ```bash if [ -n "${AI_STUDIO_API_KEY:-}" ]; then echo "AI_STUDIO_API_KEY is configured" else echo "AI_STUDIO_API_KEY is not configured" fi ``` - Never print, log, or include the token in diagnostic output. - Mask secret values in CI systems and terminal-recording environments. - If the documented command has already been used in a logged or shared context, remove accessible logs where feasible and rotate the token. - Apply minimum required permissions, expiration controls, usage limits, and monitoring to issued API credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Credential Access

High

• Category: Privilege Escalation

Content

> # Windows PowerShell
> $env:AI_STUDIO_API_KEY="您的访问令牌"
>
> # 或使用 .env 文件
> echo 'AI_STUDIO_API_KEY="您的访问令牌"' >> .env
> ```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

> # Windows PowerShell
> $env:AI_STUDIO_API_KEY="您的访问令牌"
>
> # 或使用 .env 文件
> echo 'AI_STUDIO_API_KEY="您的访问令牌"' >> .env
> ```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from openai import OpenAI

client = OpenAI(
    api_key="您的Access Token",  # 或 os.environ.get("AI_STUDIO_API_KEY")
    base_url="https://aistudio.baidu.com/llm/lmapi/v3"
)
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill repeatedly instructs users to send prompts, images, and search queries to Baidu-hosted endpoints, including web search, but never clearly warns that user data will leave the local environment and be processed by an external service. In a skill intended to help with API integration, this omission creates a real privacy and compliance risk, especially if users test with sensitive prompts, files, or internal data.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file documents enabling web search and remote API usage, which can transmit user prompts and referenced content to external services. The description does not include any warning about privacy, data sharing, or that URLs/media and prompt contents may be sent off-system.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's user-facing instructions and prompt content are entirely in Chinese, and the test prompt explicitly requires a Chinese reply. There is no indication that the locale is optional, user-selectable, or justified as a region-specific tool, which creates a language-policy concern.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: Much of the skill is written in Chinese, and several example system/user messages are hard-coded in Chinese, but the document does not state that the skill is Chinese-language only or offer an English/locale choice. This can amount to an implicit language policy constraint without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The file content, headings, parameter descriptions, and examples are all presented in Chinese, with no indication that this language choice is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and content only in Chinese, with no indication that the user can choose another language or that the file is intentionally limited to a Chinese-only regional context.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This Python file contains docstrings and console output entirely in Chinese, including setup instructions and error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code sends a prompt to a remote API using the user's API key, but the script does not explicitly warn that content will be transmitted to an external service. While it prints that it is testing the connection, there is no user-facing disclosure about the network transmission itself or any privacy implications.

Static analysis

No suspicious patterns detected.