百度文档解析vlm-parser

• Outcome: Review
• Latest audit: Sep 17, 2026 · 11:48 AM UTC
• Version: 1.0.5

Overview

This skill appears to be a legitimate Baidu document-parsing integration, but it can send full documents and credentials to external services with limited privacy warnings and one unsafe result-download pattern.

Install only if you are comfortable sending documents or document URLs to Baidu Cloud and handling Baidu API credentials locally. Avoid using it on confidential, regulated, customer, legal, financial, or identity documents unless your organization permits that processing, and treat returned result links as sensitive while they remain valid.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explains how to submit file_data or file_url to Baidu's cloud API, but it does not clearly warn users that document contents will be transmitted to a third-party service and may remain accessible via returned result URLs for up to 30 days. For document-processing skills, this omission is significant because users may unknowingly send confidential PDFs, contracts, IDs, or internal materials off-platform.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 92% confidence

Finding

The document references the agent's configuration directory and instructs users to place secrets there, which normalizes storing sensitive credentials in a high-value agent config location. In agent ecosystems, config directories are especially sensitive because they may be broadly readable by tooling, copied during troubleshooting, or included in backups and sync workflows.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 26)May include surrounding context.

export BAIDU_DOC_AI_SECRET_KEY="your_actual_secret_key_here"

text

或通过配置文件 `~/.claude/settings.json`：

```json
{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 18)May include surrounding context.

md

| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 |
| 110 | Access token invalid or no longer valid | access_token 无效 | 重新获取（30天有效期） |
| 111 | Access token expired | access_token 过期 | 重新获取 |

### 文件相关错误

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/error_codes.md (reported line 19)May include surrounding context.

md

| 18 | Open api qps request limit reached | QPS 超限 | 降低请求频率 |
| 19 | Open api total request limit reached | 总量配额超限 | 购买额外配额 |
| 100 | Invalid parameter | access_token 无效 | 重新获取 |
| 110 | Access token invalid or no longer valid | access_token 无效 | 重新获取（30天有效期） |
| 111 | Access token expired | access_token 过期 | 重新获取 |

### 文件相关错误

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents use of environment variables and outbound network access to a third-party API, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege and transparency problem: an agent may invoke network and secret-reading capabilities without prior restriction or clear review, increasing the risk of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases are broad terms like '文档解析' and 'PaddleOCR' that could match many ordinary user requests, causing the skill to activate outside clearly intended contexts. In a skill that uploads document content to a third-party API, over-broad activation increases the chance of accidental transmission of sensitive files or invoking billable external operations without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide explicitly recommends storing long-lived API credentials in ~/.claude/settings.json, which is a plaintext local configuration file, without any warning about file permissions, local compromise, backups, or accidental disclosure. While common in setup docs, this increases the chance that sensitive credentials are exposed through shared machines, dotfile sync, logs, or source control mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The verification step instructs users to transmit their API key and secret to a remote token endpoint, but does not clearly warn that this sends secret material over the network and should only be done against the official HTTPS endpoint. Although this is functionally required for OAuth token exchange, missing guidance can lead to unsafe copy/paste behavior, use in shell history, or misuse against spoofed endpoints.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/apikey-fetch.md (reported line 46)May include surrounding context.

4. 验证配置

bash

curl -X POST 'https://aip.baidubce.com/oauth/2.0/token' \
  -d 'grant_type=client_credentials' \
  -d 'client_id={your_api_key}' \
  -d 'client_secret={your_secret_key}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly states that uploaded document contents are sent to a third-party Baidu API and that the parsed results are exposed via URLs valid for 30 days, but it does not warn users about confidentiality, retention, link access scope, or the risks of uploading sensitive data. In a document-parsing skill, users are likely to submit contracts, IDs, financial records, or other regulated content, so omission of privacy and data-handling guidance can lead to inadvertent data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill uploads user-provided document contents or document URLs to Baidu's external cloud OCR service, but the code provides no explicit disclosure, consent gate, or privacy warning at the point of transmission. In a document-parsing skill, this is contextually important because inputs may contain highly sensitive business, legal, identity, or regulated data, so silent third-party transmission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'parse_result_url' from requests.post (line 158, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code blindly trusts parse_result_url returned by the remote API and performs a requests.get on it without validating the scheme, host, or whether it matches an expected Baidu domain. If the upstream service, a MITM position, or an abused API response can supply an arbitrary URL, this creates an SSRF-style outbound request primitive and could be used to reach unintended internal or sensitive network resources from the runtime environment.

Content

Scanner excerpt · scripts/baidu_doc_vlm_parser.py (reported line 160)May include surrounding context.

python

if download_result:
                        parse_result_url = result.get('result', {}).get('parse_result_url')
                        if parse_result_url:
                            parse_response = requests.get(parse_result_url)
                            parse_response.encoding = 'utf-8'
                            result['parse_result'] = parse_response.json()
                    return result

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 67% confidence

Finding

A language/locale policy concern exists when a skill forces a specific language without user opt-in. This file presents all instructions solely in Chinese and does not state that the skill is region-specific or offer an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all guidance and headings in Chinese while mixing in some English error strings, with no indication that the content is region-specific or that alternate languages are available. Under the policy check for language or locale constraints, this can be read as a fixed-language experience without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.