Auto Search using Google Baidu

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 1.5.0

Overview

This appears to be a legitimate Google/Baidu search skill, but it needs review because API keys may be exposed in error output and searches are automatically sent to external providers.

Install only if you are comfortable sending search queries to Google or Baidu. Use restricted, low-quota API keys, avoid searching for secrets or sensitive business data, and consider fixing the error handling so it never prints full credential-bearing URLs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/search.py:102
• Finding: API Credentials May Be Disclosed Through HTTP Error Logging<![CDATA[ ## Vulnerability Details **File Location**: `src/search.py:102-110`, `src/search.py:155-170`, and `src/search.py:217-241` **Vulnerability Type**: API credential exposure through unsanitized exception logging **Risk Level**: Medium ### Vulnerable Code ```python # GoogleSearch.search params = { 'q': query, 'key': self.api_key, 'cx': self.cx, 'num': min(count, 10) # API max is 10 per request } response = requests.get(self.base_url, params=params, timeout=30) response.raise_for_status() ``` ```python # BaiduSearch.search url = f"{self.base_url}/v1/search" params = { 'query': query, 'count': count, 'ak': self.api_key } headers = { 'Content-Type': 'application/json' } response = requests.get(url, params=params, headers=headers, timeout=30) response.raise_for_status() ``` ```python if selected_engine == 'google' and self.google: try: google_results = self.google.search(query, count) results.extend(google_results) except Exception as e: print(f"⚠️ Google search failed: {e}") elif selected_engine == 'baidu' and self.baidu: try: baidu_results = self.baidu.search(query, count) results.extend(baidu_results) except Exception as e: print(f"⚠️ Baidu search failed: {e}") elif selected_engine == 'both': # Search both engines if self.google: try: google_results = self.google.search(query, count) results.extend(google_results) except Exception as e: print(f"⚠️ Google search failed: {e}") if self.baidu: try: baidu_results = self.baidu.search(query, count) results.extend(baidu_results) except Exception as e: print(f"⚠️ Baidu search failed: {e}") ``` ### Technical Analysis The Google and Baidu API credentials are supplied as URL query parameters named `key` and `ak`. When `raise_for_status()` raises a `requests` HTTP exception, the exception representa ...[truncated 1755 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not print raw `requests` exceptions for requests containing credentials. 2. Log only explicitly selected, non-sensitive fields such as the provider name and HTTP status code. 3. Redact sensitive query parameters including `key`, `ak`, `token`, `access_token`, and similar credential names before logging URLs. 4. Where supported by the provider, transmit credentials in an authorization header rather than in the URL. 5. Configure API keys with least-privilege provider restrictions, including API allowlists, source restrictions, and conservative quotas. 6. Ensure production logging systems do not retain query strings containing secrets. 7. Rotate any credentials that may already have appeared in logs. For example: ```python except requests.HTTPError as exc: status = exc.response.status_code if exc.response is not None else "unknown" print(f"Google search failed with HTTP status {status}") except requests.RequestException: print("Google search failed due to a network error") ``` Apply equivalent sanitized handling to the Baidu branch and avoid exposing response bodies unless they have also been reviewed and redacted. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Dependencies Are Installed Without Reproducible Version or Integrity Constraints<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2` and `SKILL.md:50-55` **Vulnerability Type**: Unpinned third-party dependencies without hash verification **Risk Level**: Low ### Vulnerable Code ```text requests>=2.28.0 python-dotenv>=1.0.0 ``` The documented installation command is: ```bash cd ~/.openclaw/workspace/skills/google-baidu-search # Install dependencies pip3 install -r requirements.txt ``` ### Technical Analysis The dependency declarations specify only minimum versions. Each installation can therefore resolve to a different future release, and no package hashes are supplied to verify artifact integrity. This does not demonstrate that either named package is currently malicious. However, it creates a supply-chain weakness because the installed code can change after the skill has been reviewed. A compromised, malicious, or incompatible future release satisfying the minimum-version constraint could be selected automatically. Python packages can execute code during installation and are subsequently imported into the skill's process. ### Attack Path 1. A dependency account, release pipeline, package index, or distribution artifact is compromised, or an unsafe future release is published under one of the permitted package names. 2. A user follows the documented `pip3 install -r requirements.txt` command. 3. The resolver selects the newly available release because it satisfies the unrestricted `>=` constraint. 4. The package is downloaded without validation against a project-controlled cryptographic hash. 5. Malicious package behavior executes during installation or when `requests` or `dotenv` is imported. 6. The package operates with the privileges of the user or service installing or running the skill. ### Impact Assessment Potential impact is bounded by the privileges of the installation and runtime account. A compromised dependency could access environment variables, including search API credentials; read or alter ...[truncated 352 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each reviewed dependency to an exact version rather than using open-ended minimum constraints. 2. Generate and commit cryptographic hashes for all accepted distribution artifacts. 3. Install with hash enforcement, for example through a lock file or a requirements file generated by a tool such as `pip-compile --generate-hashes`. 4. Review transitive dependencies and include them in the locked dependency set. 5. Use a controlled dependency-update process that includes security scanning, compatibility testing, and code review. 6. Install packages from the official package index or a trusted internal mirror over TLS. 7. Avoid installing the skill or its dependencies with administrator or root privileges. 8. Periodically update pinned versions after reviewing security advisories rather than leaving versions permanently stale. A hardened installation should use an exact, reviewed lock set resembling: ```text requests==<reviewed-version> \ --hash=sha256:<reviewed-artifact-hash> python-dotenv==<reviewed-version> \ --hash=sha256:<reviewed-artifact-hash> ``` The actual versions and hashes must be generated from artifacts reviewed and approved by the project maintainers. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (33)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path
from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from dotenv import load_dotenv

# Load environment variables from .env file
env_path = Path(__file__).parent.parent / '.env'
if env_path.exists():
    load_dotenv(env_path)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill advertises automatic routing between Google and Baidu based on query language, which means user input is sent to a provider selected by the tool rather than by explicit user choice. This is particularly sensitive because routing Chinese-language queries to Baidu may have privacy, jurisdiction, and compliance implications users did not knowingly accept.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly describes automatic submission of user queries to Google or Baidu, but does not clearly warn that query contents are transmitted to third-party services. In a search skill, queries may contain sensitive or proprietary information, so silent forwarding creates a privacy and data-handling risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Get API Key:**
   - Visit https://console.cloud.google.com/
   - Create a new project or select existing
   - Enable "Custom Search API"
   - Go to APIs & Services → Credentials
   - Create API Key

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill advertises automatic routing of queries to Baidu or Google based on language and China-related keywords without explicit user opt-in per query. This can unexpectedly disclose user intent or sensitive content to a specific external provider and may route data across jurisdictions with different privacy expectations.

Static analysis

No suspicious patterns detected.