ClawHub
Back to skill

Security audit

China SEO Baidu

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Baidu SEO guide, but it includes an unsafe plaintext token-submission command and a global unpinned CLI install that users should review before use.

Use this skill only for Baidu/China SEO work. Do not run the HTTP `curl` submission example with a real token unless you have verified an official secure submission method or trusted network constraints; prefer Baidu's secure web interface or an HTTPS-supported endpoint, and rotate any token already sent over HTTP. If using the SmartApp CLI, prefer a pinned, project-local install or an isolated environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:47
Finding

API Token Exposed Through a Plaintext HTTP Request

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-49
Vulnerability Type: Sensitive credential transmission over plaintext HTTP
Risk Level: High

bash
curl "http://data.zz.baidu.com/urls?site=https://example.com&token=YOUR_TOKEN" \
  -H "Content-Type:text/plain" \
  --data-binary @urls.txt

Technical Analysis

The documented command sends a Baidu Webmaster API token as a URL query parameter over unencrypted HTTP. Because TLS is not used, the token and submitted URL data can be observed or modified by network intermediaries. Query-string credentials may additionally be retained in proxy logs, command histories, monitoring systems, or other URL-based logs.

The placeholder does not contain a real secret in the audited file. The vulnerability arises when a user replaces YOUR_TOKEN with an operational credential and executes the documented command.

Attack Path

  1. A user replaces YOUR_TOKEN with a valid Baidu Webmaster API token.
  2. The user executes the documented curl command.
  3. The HTTP request traverses a compromised or untrusted network, proxy, gateway, or monitoring device.
  4. An attacker captures the plaintext request or obtains the URL from intermediary logs.
  5. The attacker extracts and reuses the token to perform API operations permitted by that credential, including unauthorized URL submissions for the associated site.

Impact Assessment

Successful exploitation exposes the Baidu submission token and the contents of urls.txt. An attacker can obtain the API privileges assigned to the compromised token, but this does not inherently provide operating-system privileges. The practical scope is limited by the token's permissions and Baidu's server-side controls. Unauthorized URL submissions, indexing manipulation, service abuse, and disclosure of unpublished or sensitive submitted URLs may result.

Remediation
View remediation

Remediation Suggestions

  • Replace the plaintext endpoint with Baidu's officially supported HTTPS endpoint.
  • If the service does not support HTTPS, do not recommend direct token submission over untrusted networks; direct users to a secure official interface instead.
  • Avoid placing credentials in URL query strings where an API-supported authorization header or protected request body is available.
  • Warn users not to paste real tokens into scripts committed to source control.
  • Disable verbose request logging and redact token-bearing URLs from shell history, proxy logs, CI output, and monitoring systems.
  • Use narrowly scoped, revocable credentials and rotate any token that may already have been transmitted through this command.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:146
Finding

Unpinned Global Installation of a Third-Party npm CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:146
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

bash
npm install -g @baidu/smartapp-cli

Technical Analysis

The instruction installs the latest available release of a third-party npm package without pinning a reviewed version or verifying package integrity. npm installation can execute package lifecycle scripts, so a compromised maintainer account, registry response, or future malicious release could cause attacker-controlled code to run during installation.

The -g option installs the package globally, increasing its reach compared with a project-local dependency and making the resulting executable available to other projects and shell sessions. The audited project does not include the package itself, and no evidence establishes that the current package release is malicious; the finding concerns the unsafe dependency installation pattern.

Attack Path

  1. The npm package, its maintainer account, its dependency chain, or the registry delivery path is compromised.
  2. An attacker publishes or serves a malicious package release.
  3. A user follows the unpinned installation instruction.
  4. npm resolves the package to the compromised release.
  5. Malicious lifecycle code executes with the privileges of the user running npm.
  6. The globally installed executable can subsequently run attacker-controlled behavior when invoked as smartapp.

Impact Assessment

Exploitation could provide code execution with the privileges of the user who runs the installation command. Accessible source code, environment variables, developer credentials, npm configuration, and files writable by that account could be exposed or modified. Global installation may also affect commands used across multiple projects. This instruction does not itself request administrator privileges, so system-level compromise would require the comma ...[truncated 85 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically reviewed version, for example @baidu/smartapp-cli@<reviewed-version>.
  • Prefer a project-local development dependency over a global installation.
  • Commit and enforce a lockfile containing integrity hashes.
  • Use npm ci in automated environments to ensure reproducible dependency resolution.
  • Configure npm to use an explicitly trusted registry and verify package ownership and provenance.
  • Review the package and transitive dependency lifecycle scripts before installation.
  • Where compatible with the tool, disable lifecycle scripts during installation and enable only those that have been reviewed.
  • Run the CLI from a least-privileged account or isolated development environment rather than with administrative privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instructions frame the agent as always optimizing for Baidu and Chinese requirements, including statements such as 'Baidu is not Google' and mandatory China-specific practices, without first confirming that the user wants a China-market or Chinese-locale workflow. This can violate language/locale policy because it imposes a region-specific operating context by default rather than offering it as an explicit choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill hardcodes an HTTP endpoint for sitemap/URL submission, which can expose submitted URLs and the Baidu token to interception or tampering by a network attacker. Even if the data is not highly sensitive, leaking the token could allow unauthorized API use and leaking unpublished URLs could reveal internal site structure or content release timing.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Step 2: Submit Sitemap

bash
# Submit via Baidu Webmaster API
curl "http://data.zz.baidu.com/urls?site=https://example.com&token=YOUR_TOKEN" \
  -H "Content-Type:text/plain" \
  --data-binary @urls.txt

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill hardcodes an HTTP endpoint for sitemap/URL submission, which can expose submitted URLs and the Baidu token to interception or tampering by a network attacker. Even if the data is not highly sensitive, leaking the token could allow unauthorized API use and leaking unpublished URLs could reveal internal site structure or content release timing.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Step 2: Submit Sitemap

bash
# Submit via Baidu Webmaster API
curl "http://data.zz.baidu.com/urls?site=https://example.com&token=YOUR_TOKEN" \
  -H "Content-Type:text/plain" \
  --data-binary @urls.txt