ClawHub

Baidu Hot

Security checks across malware telemetry and agentic risk

Overview

This skill fetches public Baidu hot-search topics as advertised, with minor routing and documentation rough edges but no evidence of hidden data access or harmful behavior.

Install only if you are comfortable with the skill contacting Baidu to fetch public trending-search data. Be aware that its trigger words are broad and its documentation overstates a few features that the script does not implement.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes very generic terms such as "百度" and "baidu", which are likely to appear in normal conversation unrelated to invoking this specific skill. Overly broad triggers can cause unintended activation, leading the agent to fetch external content when the user did not explicitly request it, increasing the chance of prompt-routing mistakes and unnecessary network access.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The manifest declares very broad trigger phrases such as "百度", "热搜", and "baidu", which are common terms that may appear in many unrelated user requests. This can cause the skill to activate outside its intended context, potentially intercepting general searches or routing users into network-enabled behavior unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal