ClawHub
Back to skill

Security audit

Baidu Search Sldjs

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple Baidu search helper that opens the user's browser with the user's search query, with no hidden persistence or credential access found.

Install only if you are comfortable with the skill opening your default browser and sending the exact search text you provide to Baidu. Do not use it for confidential queries unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The core behavior broadly matches the description: it opens a browser and performs a search using the user's query. However, there are two description-behavior mismatches. First, the declared triggers are empty, but the code defines specific triggers ("百度搜索", "搜百度", "打开百度搜索"). Second, the description says 'search online' generically, while the implementation is specifically tied to Baidu. This is a materially narrower and more specific behavior than the declared purpose. No additional sensitive capabilities or undeclared resource access are present.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill describes behavior that opens a browser and performs an online search, which implies network access and likely browser/tool invocation, but it declares no explicit tool scope such as permissions or allowed-tools. Missing scope declarations weaken policy enforcement and user/agent visibility into what the skill is allowed to do, increasing the chance of unintended external access or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

Comments, trigger phrases, and user-facing text are all presented in Chinese, and the skill does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill launches the user's default browser to an external site immediately using the full query string, without any explicit confirmation or warning at execution time. While the destination is a hardcoded Baidu search URL and the query is URL-encoded, this still causes an external action and data disclosure of the user's input, which can surprise users or leak sensitive text they included in the request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.