百度文档解析vlm-parser

• Outcome: Review
• Latest audit: Jul 10, 2026 · 12:24 AM UTC
• Version: 1.0.4

Overview

The skill is a Baidu cloud document parser, but its shipped CLI ignores user-supplied files and queries a hard-coded Baidu task while using user credentials.

Install only after reviewing the script behavior. Do not use it with confidential documents unless sending them to Baidu cloud is approved, protect the Baidu API key and secret key, and fix or verify the CLI so it parses the user-selected file rather than querying the hard-coded task ID.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'parse_result_url' from requests.post (line 158, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if download_result:
                        parse_result_url = result.get('result', {}).get('parse_result_url')
                        if parse_result_url:
                            parse_response = requests.get(parse_result_url)
                            parse_response.encoding = 'utf-8'
                            result['parse_result'] = parse_response.json()
                    return result

• Confidence: 90% confidence
• Finding: The code takes a URL returned by a remote API response and fetches it directly with requests.get() without validating the host, scheme, or expected domain. If that upstream response is compromised, malformed, or attacker-influenced, the client can be induced to make unintended outbound requests, creating an SSRF-style trust-boundary issue and potentially exposing metadata, internal services, or causing retrieval of malicious content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents use of environment variables and outbound network access to a cloud OCR API, but it does not declare those capabilities as permissions. Missing permission disclosure weakens user consent and reviewability, because the skill can access secrets and transmit document data externally without an explicit capability declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose is document parsing, but the finding indicates additional behavior such as token acquisition, standalone task-status querying, and a CLI path that does not match the described submit-then-parse flow. Description/behavior mismatches are dangerous because reviewers and users cannot accurately assess what data is accessed, what remote actions are possible, or whether the tool can enumerate or inspect unrelated tasks.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Broad trigger phrases like generic document/OCR requests can cause the skill to activate in more situations than users expect. In a skill that transmits files to a third-party API, overbroad activation increases the chance of accidental processing and external disclosure of sensitive documents.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill description does not warn that document contents may be sent to a third-party cloud API. This omission is significant because users may provide sensitive PDFs, images, or office documents without informed consent about external transmission, retention windows, or provider-side access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to place long-lived API credentials directly into shell environment variables and a local settings file without any warning about secret exposure risks. This can lead to accidental disclosure through shell history, process inspection, backups, dotfile syncing, logs, or insecure file permissions, especially because both the API key and secret key are sufficient to obtain access tokens.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to upload full documents to a third-party cloud API and notes that result artifacts are exposed through 30-day URLs, but it does not warn about sensitive-data handling, external transmission, retention, or access-control implications. In a document-parsing skill, users may submit contracts, IDs, financial files, or other confidential materials, so omission of privacy and retention guidance can cause unintended disclosure or non-compliant data processing.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.