百度文档解析pipeline-parser

• Outcome: Review
• Latest audit: Jul 10, 2026 · 12:23 AM UTC
• Version: 1.0.7

Overview

This skill is a disclosed Baidu document-parsing helper, but users should treat uploaded documents, result links, and API keys as sensitive.

Install only if you are comfortable sending the selected documents or document URLs to Baidu for processing. Avoid using it on confidential, regulated, or internal-only documents unless your organization approves that data flow. Prefer environment variables or a dedicated secret store for API keys, and do not share or log the 30-day result URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'parse_result_url' from requests.post (line 183, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if download_result:
                        parse_result_url = result.get('result', {}).get('parse_result_url')
                        if parse_result_url:
                            parse_response = requests.get(parse_result_url)
                            parse_response.encoding = 'utf-8'
                            result['parse_result'] = parse_response.json()
                    return result

• Confidence: 94% confidence
• Finding: The code takes `parse_result_url` directly from a remote API response and performs `requests.get()` on it without validating the scheme, host, or path. This creates an SSRF-style trust boundary issue: if the upstream API, response path, or network traffic is compromised, the client can be induced to fetch arbitrary URLs, including internal services or unexpected external endpoints. In this skill context, the risk is somewhat elevated because the tool is explicitly designed to process user-supplied documents and automatically follow service-provided result URLs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly requires environment secrets and outbound network access to call Baidu APIs, but it does not declare those permissions explicitly. This weakens host-side policy enforcement and user awareness, making it easier for the skill to access credentials and transmit document contents externally without clear consent boundaries.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill description says it parses user documents via Baidu cloud APIs but does not warn that document contents, tables, OCR text, and possibly sensitive files will be transmitted to a third-party external service. In a document-processing skill, this context makes the omission more serious because users may submit contracts, IDs, financial records, or internal documents without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill documents markdown and JSON result links that remain valid for 30 days but does not warn users that parsed document outputs persist remotely for that period and may be retrievable by anyone with the URL, depending on access controls. For document parsing, this increases confidentiality risk because extracted text and structured outputs can contain highly sensitive information beyond the original file itself.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide explicitly instructs users to place long-lived API credentials in a JSON settings file in plaintext, but does not warn about file permission hardening, secret leakage through backups/sync, or safer secret storage alternatives. This increases the chance that sensitive credentials are exposed to other local users, source control, cloud sync tools, or support bundles.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly instructs users to upload documents via remote URL and later download parsed results from time-limited links, but it does not warn that sensitive documents and extracted content are being sent to and stored by a third-party service. In a document-parsing skill, this omission can lead users to process confidential files without understanding privacy, retention, link-sharing, or access-control risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This client sends document contents or document URLs to Baidu's external parsing API, but the CLI and code do not provide an explicit privacy/security warning or confirmation step. That can lead to unintended disclosure of sensitive documents, credentials embedded in files, regulated data, or internal-only URLs to a third party. In a document-parsing skill, external transmission is expected, but that context makes user awareness more important, not less.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

#### 方式二：通过配置文件

编辑配置文件：`~/.claude/settings.json` 或项目 `.claude/settings.json`

添加以下结构：

• Confidence: 88% confidence
• Finding: The document directs users to modify ~/.claude/settings.json, an agent configuration location, to insert raw API secrets. Referencing a high-value agent config path for secret storage is risky because such files may be broadly readable by local tooling, accidentally shared, or later consumed by other agent features, increasing the blast radius of credential compromise.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/error_codes.md:104