Baidu Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:09 AM UTC
• Version: 2.1.2

Overview

This is a coherent Baidu search skill, but it handles the Baidu API key in a way that could expose it in error output.

Review this before installing if the Baidu API key has billing, quota, or account privileges. The skill should avoid returning raw HTTP exception strings and should redact the ak parameter or use a safer provider-supported authentication method. Install it in an isolated environment and pin dependencies before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search.py:49
• Finding: API Key Exposure Through Unsanitized HTTP Exception Output<![CDATA[ ## Vulnerability Details **File Location**: `src/baidu_search.py`, lines 49-60 and 93-94 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```python params = { 'query': query, 'count': count, 'ak': self.api_key } headers = { 'Content-Type': 'application/json' } response = requests.get(url, params=params, headers=headers, timeout=30) response.raise_for_status() ``` ```python except Exception as e: return f"❌ Search failed: {str(e)}" ``` ### Technical Analysis The Baidu API key is transmitted through the `ak` URL query parameter. When `response.raise_for_status()` raises a `requests.exceptions.HTTPError`, the exception message can include the complete requested URL. Because the URL contains the API key, converting the exception to a string and returning it without sanitization may expose the credential. The returned error may subsequently be displayed to users or recorded in agent transcripts, application logs, monitoring systems, or other downstream output channels. TLS protects the request while it is in transit but does not prevent credential exposure through local exception formatting, URL logging, proxy logs, or server-side request logs. ### Attack Path 1. An attacker or ordinary user submits a search request that results in an HTTP error, or waits for an upstream authentication, rate-limit, or service error. 2. The client constructs a request URL containing `ak=<BAIDU_API_KEY>`. 3. `response.raise_for_status()` raises an exception whose text may contain the requested URL. 4. The broad exception handler converts the exception to a string without redaction. 5. The resulting error text is returned to the caller and may reveal the API key. 6. Anyone with access to that output can reuse the exposed key against the Baidu API until it is revoked or expires. ### Impact Assessment Successful exploitation can disclose the configured Baidu API credential. The exposed key provides ...[truncated 378 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use a provider-supported authorization header or protected request body instead of a URL query parameter whenever the Baidu API permits it. 2. Do not return raw exception strings to callers. Return a generic failure message and retain only sanitized diagnostics. 3. Explicitly redact sensitive query parameters such as `ak` from exception messages, request URLs, and logs. 4. Catch expected exception types separately, including `Timeout`, `ConnectionError`, and `HTTPError`. 5. If server-side diagnostics are needed, log the status code and a generated request identifier rather than the complete URL. 6. Ensure reverse proxies, HTTP debugging facilities, and monitoring platforms do not record sensitive query strings. 7. Rotate the API key if affected exception output may already have been retained. Example hardened handling: ```python try: response = requests.get(url, params=params, headers=headers, timeout=30) response.raise_for_status() except requests.exceptions.Timeout: return "❌ Search failed: the upstream service timed out." except requests.exceptions.HTTPError: return "❌ Search failed: the upstream service returned an HTTP error." except requests.exceptions.RequestException: return "❌ Search failed: unable to contact the upstream service." ``` ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded and Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt`, lines 1-2 **Vulnerability Type**: Non-reproducible dependency resolution and supply-chain exposure **Risk Level**: Low ### Vulnerable Code ```text requests>=2.28.0 python-dotenv>=1.0.0 ``` The documented installation command resolves these mutable requirements directly: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis Both dependencies specify only minimum versions. There are no exact version pins, lock file, integrity hashes, or upper bounds. Consequently, installations performed at different times can resolve to different releases that were not reviewed with this project. The package names are legitimate and there is no evidence that the currently specified dependencies are malicious. The security concern is that future compromised, vulnerable, or behaviorally incompatible releases would satisfy these constraints and could be installed automatically. Python packages may execute code during installation and are imported at runtime by the skill. ### Attack Path 1. A user follows the documented installation procedure. 2. `pip` queries the configured package index and resolves the newest releases satisfying the minimum-version constraints. 3. A future compromised or otherwise unsafe release satisfies `>=2.28.0` or `>=1.0.0`. 4. The release is downloaded and installed without an integrity hash comparison against a reviewed artifact. 5. Package-controlled code can execute during installation or when `requests` or `dotenv` is imported. This path depends on compromise or unsafe publication of an allowed dependency release; no such compromise was established during this audit. ### Impact Assessment The potential impact is determined by the privileges of the account performing installation or running the skill. A compromised dependency could access the process environment, including `BAIDU_API_KEY`, perform network operations, modify files writable by the process, ...[truncated 230 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to a reviewed exact version rather than using an unrestricted minimum version. 2. Generate and commit a lock file or fully resolved requirements file for reproducible installations. 3. Record cryptographic hashes for all distributions and install with hash enforcement, such as `pip install --require-hashes`. 4. Use an automated dependency scanner and update pinned versions through reviewed pull requests. 5. Install from a trusted package index and restrict unexpected index or mirror configuration. 6. Run installation and execution under a least-privileged account or isolated virtual environment. 7. After pinning, verify that the selected versions receive current security fixes and update them on a controlled schedule. Illustrative format: ```text requests==<reviewed-version> --hash=sha256:<verified-hash> python-dotenv==<reviewed-version> --hash=sha256:<verified-hash> ``` ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Credential Access

High

• Category: Privilege Escalation

Content

### 3. Configure API Key

```bash
# Get API key from: https://ai.baidu.com/
export BAIDU_API_KEY="your_api_key"
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The feature list explicitly says the skill is 'Chinese Focus - 专注中文搜索', which imposes a locale/language constraint in the natural-language description. The file does not indicate that users can opt into this behavior or choose another language/locale, so it matches the policy-violation criterion for forced language/locale behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 🚀 Installation

### 1. Clone or Create

```bash
cd ~/.openclaw/workspace/skills

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The feature list states the skill is 'Chinese Focus' and dedicated to Chinese search results, which imposes a language/locale preference in the skill description. The file does not clearly present this as an optional user choice or explain a specific compliance or regional requirement that would justify the restriction.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
python-dotenv>=1.0.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.28.0`), so builds may resolve to different versions over time. This weakens supply-chain control and can unintentionally introduce vulnerable or breaking releases, especially given that `requests` has known advisories across some versions.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The manifest does not pin `requests`, and the package has multiple known advisories in some versions, so the project cannot demonstrate that it avoids affected releases. While the file alone does not prove a vulnerable version is installed, the unverifiable version selection is a real supply-chain weakness because deployment may pull an affected release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
python-dotenv>=1.0.0

• Confidence: 96% confidence
• Finding: `python-dotenv>=1.0.0` is not pinned to a specific version, which makes installations non-reproducible and reduces assurance about what code will actually be deployed. This increases supply-chain risk and makes it hard to verify whether deployed versions are affected by published advisories.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Because `python-dotenv` is unpinned and has known advisories affecting some releases, it is impossible to verify from this manifest whether the installed version is safe. This creates avoidable uncertainty in the dependency chain and could allow an affected version to be installed in some environments.

Static analysis

No suspicious patterns detected.