ClawHub
Back to skill

Security audit

baidu web search

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Baidu web-search skill, but it needs review because it handles an API key, sends user queries to Baidu, and has incomplete/misleading safeguards around credential storage.

Review before installing. Use platform-injected BAIDU_API_KEY rather than a local config.json when possible, avoid sending private or regulated information as search queries, and check the package's dependency lock/pinning and gitignore handling before sharing or committing the skill directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
package.json:5
Finding

Non-Reproducible Dependency Installation Without a Lockfile

Content
View full analysis

Vulnerability Details

File Location: package.json:5-7; SKILL.md:87,95
Vulnerability Type: Unpinned third-party dependency and non-reproducible installation
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "axios": "^1.6.0"
}

The installation documentation instructs users to run:

bash
npm install

No package-lock.json is included in the audited project.

Technical Analysis

The caret version range permits npm to install later compatible Axios releases rather than a single audited version. The absence of a lockfile also leaves transitive dependencies unconstrained. Consequently, two installations performed at different times may produce materially different dependency trees.

This is a supply-chain weakness rather than evidence that the current Axios package is malicious. If a permitted future release or transitive package is compromised, installation may introduce code that was not present during the audit. Depending on package metadata, lifecycle scripts could also execute during installation.

Attack Path

  1. An attacker compromises a dependency release or one of its transitive dependencies.
  2. The compromised version remains compatible with the declared ^1.6.0 range.
  3. A user follows the documentation and executes npm install.
  4. npm resolves and downloads the unaudited version.
  5. Malicious lifecycle or runtime code executes with the privileges of the installing or invoking user.
  6. Because the search process can access BAIDU_API_KEY, compromised runtime code could potentially read and disclose that credential.

Impact Assessment

Exploitation could execute arbitrary JavaScript with the privileges of the account installing or running the skill. Potential scope includes access to the skill process environment, the local API-key configuration, files accessible to that account, and outbound network connectivity. No current malicious depend ...[truncated 35 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin Axios to a specifically reviewed version instead of using a caret range.
  2. Generate, review, and commit package-lock.json.
  3. In deployment and automated installation workflows, use npm ci rather than npm install.
  4. Run dependency vulnerability and integrity checks during release preparation.
  5. Consider disabling lifecycle scripts with npm ci --ignore-scripts if the dependency tree does not require them.
  6. Periodically update dependencies through a controlled review process rather than resolving new versions implicitly.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.js:8
Finding

Plaintext API-Key Configuration Is Not Protected by the Documented Ignore Rule

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37,90-94,138; scripts/search.js:8,19-28
Vulnerability Type: Plaintext credential storage and missing repository exclusion
Risk Level: Medium

Vulnerable Code

javascript
const SKILL_ROOT = path.resolve(__dirname, '..');
const CONFIG_PATH = path.join(SKILL_ROOT, 'config.json');

function resolveApiKey() {
  const envKey = (process.env.BAIDU_API_KEY || '').trim();
  if (envKey) return envKey;

  if (!fs.existsSync(CONFIG_PATH)) return '';
  try {
    const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
    return (cfg.apiKey || '').trim();
  } catch (e) {
    return '';
  }
}

The documentation directs local users to create config.json and place apiKey in it. It also claims that .gitignore excludes config.json. However, no .gitignore file exists in the supplied project structure.

Technical Analysis

The local configuration flow stores the Baidu API key in plaintext under the project root. Plaintext configuration is not inherently exploitable when properly permissioned and excluded from repositories, but the specific safeguard claimed by the documentation is absent.

A user may reasonably rely on the documented ignore behavior, create config.json, and then commit or package the project without realizing that the credential is included. The exposure mechanism does not require code execution; it can occur through ordinary source-control, archive, backup, or file-sharing operations.

Attack Path

  1. A user copies config.example.json to config.json.
  2. The user inserts a valid Baidu API key into the plaintext apiKey field.
  3. The user relies on the documentation's statement that config.json is ignored.
  4. Because the project contains no .gitignore, source-control tooling includes the file unless the user has an unrelated global ignore rule.
  5. The user commits, uploads, archives, or shares the proj ...[truncated 511 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add and ship a project-root .gitignore containing:
    gitignore
    /config.json
  2. Prefer environment injection or an operating-system secret store over a plaintext project file.
  3. If file-based configuration remains supported, validate or recommend restrictive permissions such as owner-only read and write access.
  4. Add a pre-commit secret scanner and CI checks that reject tracked config.json files or recognizable API-key patterns.
  5. Update the documentation so it accurately reflects the safeguards included in the package.
  6. Provide credential-rotation instructions for users who accidentally commit or share the file.

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:16
Finding

Skill Documentation Asserts Unconditional Instruction Priority Over the Host Agent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-28,100
Vulnerability Type: Skill-level instruction priority and tool-use restriction
Risk Level: Low

Vulnerable Instruction Excerpt

The relevant instructions state, in English translation:

text
Privacy and security: highest priority and may not be violated under any conditions.

The caller may only complete searches by executing node scripts/search.js
and may not access credentials through any other method.

Only execute:
node scripts/search.js "<query>" [num_results]

Technical Analysis

A skill may define safe operating guidance for its own interface, but it should not declare that its instructions have unconditional priority over platform, developer, or authorized user controls. Here, the documentation attempts to govern the host agent's available tools and actions rather than limiting itself to explaining the script's credential-handling contract.

The apparent intent is to prevent credential disclosure, and the audit found no instruction directing the agent to advertise, disable platform safety controls, contact an unrelated party, or execute a hidden payload. Nevertheless, unconditional priority language is an instruction-hijacking pattern because an agent that accepts it could allow skill-provided text to override legitimate higher-priority operations.

Attack Path

  1. The host agent loads SKILL.md as operational instructions.
  2. The agent interprets the skill's “highest priority” statement as authoritative.
  3. A platform administrator or authorized user requests a legitimate audit, incident-response, or configuration-maintenance operation.
  4. The agent refuses the authorized operation or unnecessarily restricts tool use because the skill text claims unconditional precedence.
  5. The current session's goals or controls are altered by instructions originating from the loaded skill.

Impact Assessment

The issue ca ...[truncated 411 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove phrases asserting “highest priority” or applicability “under any conditions.”
  2. Present credential protections as scoped interface requirements rather than authority over the host agent.
  3. Explicitly state that platform, system, developer, and authorized administrative policies take precedence.
  4. Replace broad tool prohibitions with a narrow statement that normal search operations should invoke scripts/search.js and that credentials should not be displayed.
  5. Allow authorized auditing, incident response, and configuration management under the host platform's established permission model.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares access to an environment-provided secret (BAIDU_API_KEY) in metadata but does not declare an explicit tool scope such as allowed tools or permissions boundaries. In an agent ecosystem, missing scope declarations can let the orchestrator invoke the skill more broadly than intended and makes it harder to enforce least privilege around shell/env access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level description includes very broad activation cues like '查一下', '搜一下', '最近', '今天', and '今年', which overlap with ordinary conversation and can cause the skill to auto-activate when the user did not specifically request web access. This increases the chance of unintended external requests, privacy leakage of user queries to Baidu, and unnecessary use of a credentialed capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The 'when to use' section repeats ambiguous trigger phrases without clear boundaries, encouraging broad automatic invocation for many common requests. In context, this is more dangerous because the skill performs live network retrieval through a third-party API, so accidental triggering can expose user prompts and browsing intent outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code sends the raw user query to Baidu's external web search API, which can expose sensitive or personal information if users enter secrets, internal data, or regulated content. The skill's purpose is web retrieval, so external transmission is expected, but the absence of an explicit disclosure, consent mechanism, or query-sensitivity guard still creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The description specifies invocation examples only in Chinese, which can amount to a language-specific policy choice without any opt-in or alternative language guidance. There is no statement that the skill supports other languages or that Chinese-only behavior is a justified regional constraint.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency uses a caret range (^1.6.0), which allows newer minor and patch releases to be installed without explicit review. This weakens build reproducibility and can unexpectedly pull in a vulnerable or breaking version through the supply chain, especially for a skill that performs network retrieval.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json
"license": "MIT-0",
  "private": true,
  "dependencies": {
    "axios": "^1.6.0"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The manifest references axios without an exact pinned version, and the package has multiple published advisories across versions. Because this skill is a web-search integration that makes outbound HTTP requests, use of an affected axios release could expose the skill to request-handling issues such as SSRF-related proxy bypasses, credential leakage, or other client-side request manipulation flaws depending on the resolved version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.