Baidu Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:09 AM UTC
• Version: 2.1.2

Overview

This is a coherent Baidu search skill, but it handles the Baidu API key in a way that could expose it in error output.

Review this before installing if the Baidu API key has billing, quota, or account privileges. The skill should avoid returning raw HTTP exception strings and should redact the ak parameter or use a safer provider-supported authentication method. Install it in an isolated environment and pin dependencies before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search.py:49

Finding

API Key Exposure Through Unsanitized HTTP Exception Output

Content

View full analysis

`. 3. `response.raise_for_status()` raises an exception whose text may contain the requested URL. 4. The broad exception handler converts the exception to a string without redaction. 5. The resulting error text is returned to the caller and may reveal the API key. 6. Anyone with access to that output can reuse the exposed key against the Baidu API until it is revoked or expires. ### Impact Assessment Successful exploitation can disclose the configured Baidu API credential. The exposed key provides ...[truncated 378 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded and Unverified Third-Party Dependencies

Content

View full analysis

=2.28.0 python-dotenv>=1.0.0 ``` The documented installation command resolves these mutable requirements directly: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis Both dependencies specify only minimum versions. There are no exact version pins, lock file, integrity hashes, or upper bounds. Consequently, installations performed at different times can resolve to different releases that were not reviewed with this project. The package names are legitimate and there is no evidence that the currently specified dependencies are malicious. The security concern is that future compromised, vulnerable, or behaviorally incompatible releases would satisfy these constraints and could be installed automatically. Python packages may execute code during installation and are imported at runtime by the skill. ### Attack Path 1. A user follows the documented installation procedure. 2. `pip` queries the configured package index and resolves the newest releases satisfying the minimum-version constraints. 3. A future compromised or otherwise unsafe release satisfies `>=2.28.0` or `>=1.0.0`. 4. The release is downloaded and installed without an integrity hash comparison against a reviewed artifact. 5. Package-controlled code can execute during installation or when `requests` or `dotenv` is imported. This path depends on compromise or unsafe publication of an allowed dependency release; no such compromise was established during this audit. ### Impact Assessment The potential impact is determined by the privileges of the account performing installation or running the skill. A compromised dependency could access the process environment, including `BAIDU_API_KEY`, perform network operations, modify files writable by the process, ...[truncated 230 chars]

Remediation

View remediation

--hash=sha256: python-dotenv== --hash=sha256: ``` ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

3. Configure API Key

bash

# Get API key from: https://ai.baidu.com/
export BAIDU_API_KEY="your_api_key"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/baidu_search.py (reported line 15)May include surrounding context.

python

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/baidu_search.py (reported line 29)May include surrounding context.

python

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/baidu_search.py (reported line 16)May include surrounding context.

python

from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The feature list explicitly says the skill is 'Chinese Focus - 专注中文搜索', which imposes a locale/language constraint in the natural-language description. The file does not indicate that users can opt into this behavior or choose another language/locale, so it matches the policy-violation criterion for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

🚀 Installation

1. Clone or Create

bash

cd ~/.openclaw/workspace/skills

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The feature list states the skill is 'Chinese Focus' and dedicated to Chinese search results, which imposes a language/locale preference in the skill description. The file does not clearly present this as an optional user choice or explain a specific compliance or regional requirement that would justify the restriction.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.28.0), so builds may resolve to different versions over time. This weakens supply-chain control and can unintentionally introduce vulnerable or breaking releases, especially given that requests has known advisories across some versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin requests, and the package has multiple known advisories in some versions, so the project cannot demonstrate that it avoids affected releases. While the file alone does not prove a vulnerable version is installed, the unverifiable version selection is a real supply-chain weakness because deployment may pull an affected release.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

python-dotenv>=1.0.0 is not pinned to a specific version, which makes installations non-reproducible and reduces assurance about what code will actually be deployed. This increases supply-chain risk and makes it hard to verify whether deployed versions are affected by published advisories.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
python-dotenv>=1.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because python-dotenv is unpinned and has known advisories affecting some releases, it is impossible to verify from this manifest whether the installed version is safe. This creates avoidable uncertainty in the dependency chain and could allow an affected version to be installed in some environments.

Content

No source excerpt is available for this finding.