baidu-aistudio-llm-api

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:11 AM UTC
• Version: 1.0.3

Overview

This is a coherent Baidu AI Studio API helper, but it needs Review because its setup guidance can expose the user's API token and installs an unpinned dependency.

Review before installing. Use a virtual environment, pin the `openai` package version if possible, do not run `echo $AI_STUDIO_API_KEY`, and treat all prompts, files, image URLs, search queries, and embeddings input as data sent to Baidu AI Studio services under that provider's policies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

bash

pip install openai

Technical Analysis

The setup instructions install the latest available openai package without a version constraint, lock file, or cryptographic hash verification. Consequently, the dependency resolved when a user installs the Skill may differ from the version that was reviewed.

Although no malicious dependency is currently demonstrated, this mutable installation process creates a supply-chain exposure. A compromised package release, package-index account, or unexpectedly unsafe future version could introduce arbitrary code that runs during installation or when the scripts import OpenAI.

Attack Path

1. An attacker compromises the upstream package distribution process or publishes a malicious release through a compromised maintainer account.
2. A user follows the documented pip install openai instruction after that release becomes the latest version.
3. The package manager downloads and installs the altered package without validating a reviewed version or expected hash.
4. Malicious package code executes during installation or when scripts/test_connection.py or scripts/list_models.py imports the package.
5. The code operates with the privileges of the user running the installation or script.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Depending on that user's access, the malicious dependency could read environment variables such as AI_STUDIO_API_KEY, access user-readable files, make network requests, alter local files, or consume API quota. The scope is limited by the privileges and isolation controls applied to the Python environment.

Remediation

View remediation

Remediation Suggestions

• Pin openai to a specifically reviewed version rather than installing the mutable latest release.
• Maintain dependencies in a lock file generated through a controlled review process.
• Require verified package hashes during installation, such as with pip install --require-hashes -r requirements.txt.
• Review and deliberately update the pinned version on a defined schedule.
• Install dependencies inside an isolated virtual environment or container with minimal filesystem and credential access.
• Use a trusted package index and monitor dependency advisories and package ownership changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

API Token Disclosure Through Terminal Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code:

bash

echo $AI_STUDIO_API_KEY

Technical Analysis

The documented check prints the complete API token to standard output. The command only needs to determine whether the environment variable is configured, but it exposes the token value itself.

Standard output may be retained in terminal scrollback, shell-session recordings, CI logs, remote support transcripts, Agent tool output, screen captures, or shared terminal sessions. Quoting the variable would not address the disclosure because the underlying problem is printing the secret rather than checking its presence.

Attack Path

1. A user exports a valid AI_STUDIO_API_KEY.
2. The user follows the documented command to verify the configuration.
3. The complete token is printed to the terminal.
4. Terminal output is recorded, logged, shared, observed, or otherwise accessed by an unauthorized party.
5. That party copies the token and submits authenticated requests to the Baidu AI Studio API.
6. The token remains usable until it expires or is revoked.

Impact Assessment

An attacker who obtains the token could authenticate within the permissions assigned to that credential, invoke available models, consume the associated quota, and potentially access other API functionality authorized for the account. This finding does not grant local privilege escalation; its scope is bounded by the leaked token's server-side permissions, validity period, rate limits, and account controls.

Remediation

View remediation

Remediation Suggestions

• Replace the command with a presence check that does not reveal the value:

  bash

  if [ -n "${AI_STUDIO_API_KEY:-}" ]; then
    echo "AI_STUDIO_API_KEY is configured"
  else
    echo "AI_STUDIO_API_KEY is not configured"
  fi
  

• Never print, log, or include the token in diagnostic output.
• Mask secret values in CI systems and terminal-recording environments.
• If the documented command has already been used in a logged or shared context, remove accessible logs where feasible and rotate the token.
• Apply minimum required permissions, expiration controls, usage limits, and monitoring to issued API credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

> # Windows PowerShell
> $env:AI_STUDIO_API_KEY="您的访问令牌"
>
> # 或使用 .env 文件
> echo 'AI_STUDIO_API_KEY="您的访问令牌"' >> .env
> ```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

> # Windows PowerShell
> $env:AI_STUDIO_API_KEY="您的访问令牌"
>
> # 或使用 .env 文件
> echo 'AI_STUDIO_API_KEY="您的访问令牌"' >> .env
> ```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api_params.md (reported line 9)May include surrounding context.

from openai import OpenAI

client = OpenAI( api_key="您的Access Token", # 或 os.environ.get("AI_STUDIO_API_KEY") base_url="https://aistudio.baidu.com/llm/lmapi/v3" )

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/list_models.py (reported line 6)May include surrounding context.

python

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_connection.py (reported line 6)May include surrounding context.

python

测试星河社区大模型API连接

使用方法:
1. 设置环境变量: export AI_STUDIO_API_KEY="您的Access Token"
2. 运行脚本: python test_connection.py
"""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill repeatedly instructs users to send prompts, images, and search queries to Baidu-hosted endpoints, including web search, but never clearly warns that user data will leave the local environment and be processed by an external service. In a skill intended to help with API integration, this omission creates a real privacy and compliance risk, especially if users test with sensitive prompts, files, or internal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents enabling web search and remote API usage, which can transmit user prompts and referenced content to external services. The description does not include any warning about privacy, data sharing, or that URLs/media and prompt contents may be sent off-system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's user-facing instructions and prompt content are entirely in Chinese, and the test prompt explicitly requires a Chinese reply. There is no indication that the locale is optional, user-selectable, or justified as a region-specific tool, which creates a language-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Much of the skill is written in Chinese, and several example system/user messages are hard-coded in Chinese, but the document does not state that the skill is Chinese-language only or offer an English/locale choice. This can amount to an implicit language policy constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file content, headings, parameter descriptions, and examples are all presented in Chinese, with no indication that this language choice is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and content only in Chinese, with no indication that the user can choose another language or that the file is intentionally limited to a Chinese-only regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains docstrings and console output entirely in Chinese, including setup instructions and error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code sends a prompt to a remote API using the user's API key, but the script does not explicitly warn that content will be transmitted to an external service. While it prints that it is testing the connection, there is no user-facing disclosure about the network transmission itself or any privacy implications.

Content

No source excerpt is available for this finding.