百度文档解析pipeline-parser

• Outcome: Review
• Latest audit: Sep 17, 2026 · 11:23 AM UTC
• Version: 1.0.8

Overview

This skill is a straightforward Baidu document parsing integration, but users should treat uploaded documents, result links, and Baidu API credentials as sensitive.

Install only if you are comfortable sending selected documents or public document URLs to Baidu for processing. Do not process confidential, regulated, or credential-containing files without approval, treat returned markdown_url and parse_result_url links as sensitive for their 30-day lifetime, and store Baidu API keys in a secure location rather than committed project settings or shared config files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 30)May include surrounding context.

md

#### 方式二：通过配置文件

编辑配置文件：`~/.claude/settings.json` 或项目 `.claude/settings.json`

添加以下结构：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 19)May include surrounding context.

md

| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 access_token |
| 110 | Access token invalid or no longer valid | access_token 无效 | token 有效期 30 天，重新获取 |
| 111 | Access token expired | access_token 过期 | token 有效期 30 天，重新获取 |

### 文件相关错误

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 20)May include surrounding context.

md

| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 access_token |
| 110 | Access token invalid or no longer valid | access_token 无效 | token 有效期 30 天，重新获取 |
| 111 | Access token expired | access_token 过期 | token 有效期 30 天，重新获取 |

### 文件相关错误

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation indicates it requires environment variables and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency gap: an agent may invoke the skill without clear policy boundaries, increasing the risk of unintended secret access or unauthorized external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to provide file content or a public file URL to a third-party Baidu API, but it does not clearly warn that document data will leave the local environment and be processed externally. This can lead to inadvertent disclosure of sensitive documents, credentials embedded in files, or internal URLs, especially because parsed result links may remain accessible for up to 30 days.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to store long-lived API credentials in shell environment variables and plaintext Claude settings files without any warning about secret exposure risks. This can lead to accidental disclosure through shell history, process/environment inspection, backups, shared home directories, or committed project configuration files.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 55)May include surrounding context.

bash

# 验证 access_token 是否可正常获取
curl -X POST 'https://aip.baidubce.com/oauth/2.0/token' \
  -d 'grant_type=client_credentials' \
  -d 'client_id={your_api_key}' \
  -d 'client_secret={your_secret_key}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API examples place access_token in the request URL without warning that it is a sensitive credential. Tokens embedded in URLs are commonly exposed through logs, browser history, proxies, analytics, error traces, and referrer leakage, increasing the chance of credential compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation encourages use of file_url uploads and describes downloadable result links, but it does not warn that documents are sent to a third-party service and that returned URLs may expose parsed content for up to 30 days. In a document-parsing skill, users may upload sensitive files, so lack of disclosure can lead to unintended data externalization and link sharing risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This skill is explicitly designed to upload document contents or document URLs to Baidu's external APIs, but the code provides no explicit disclosure, confirmation, or guardrail around sending potentially sensitive user data to a third-party service. In an agent skill context, that can cause unintended data exfiltration if users or calling systems do not realize private documents are leaving the local environment.

Content

No source excerpt is available for this finding.

Tainted flow: 'parse_result_url' from requests.post (line 183, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 96% confidence

Finding

The code takes parse_result_url from a remote API response and fetches it directly with requests.get() without validating the scheme, host, or destination. If the upstream service is compromised, misconfigured, or tricked into returning an attacker-controlled URL, this creates an SSRF-style outbound request primitive that could reach unexpected internal or sensitive network resources from the runtime environment.

Content

Scanner excerpt · scripts/baidu_doc_parser.py (reported line 185)May include surrounding context.

python

if download_result:
                        parse_result_url = result.get('result', {}).get('parse_result_url')
                        if parse_result_url:
                            parse_response = requests.get(parse_result_url)
                            parse_response.encoding = 'utf-8'
                            result['parse_result'] = parse_response.json()
                    return result

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The argument parser forces a default language_type of "CHN_ENG" when the user does not explicitly choose a language. This is a natural-language policy concern because it imposes a locale/language behavior by default rather than making the choice explicit or documenting a justified constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/error_codes.md:104