Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Baidu web-search helper that uses a Baidu API key and sends search queries to Baidu, with some install and privacy caveats but no artifact-backed malicious behavior.
Install only if you are comfortable sending search queries to Baidu and providing a Baidu Qianfan API key. Prefer platform-managed environment variables over a local config file, avoid putting secrets in shared chats or screenshots, and pin dependencies with a lockfile before using this in a higher-trust environment.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
package.json:5
Finding
Unpinned Dependency Without a Lockfile Enables Supply-Chain Drift
Content
View full analysis
Vulnerability Details
File Location: package.json:5-7 Vulnerability Type: Unpinned third-party dependency and non-reproducible installation Risk Level: Medium
The affected dependency declaration is:
json
"dependencies": {
"axios": "^1.6.0"
}
The installation instructions in SKILL.md:103 and SKILL.md:110 direct users to run:
bash
npm install
Technical Analysis
The caret constraint permits npm to select later compatible Axios releases rather than the exact version reviewed with this project. The project also has no committed package-lock.json, so Axios and its transitive dependency graph are not locked to verified package versions and integrity hashes.
As a result, two installations performed at different times may install different code. If an allowed future dependency release or transitive package is compromised, malicious code could enter the installation without any change to this repository. npm package lifecycle scripts may execute during installation, while compromised runtime code loaded through require('axios') would execute with the privileges of the Node.js process.
This finding does not establish that the currently declared Axios package is malicious. The risk arises from mutable dependency resolution and the absence of a reproducible, integrity-locked installation process.
Attack Path
An attacker compromises a future Axios release accepted by ^1.6.0, or compromises a transitive dependency selected by npm.
A user follows the documented instruction and runs npm install.
Because no lockfile fixes versions and integrity hashes, npm resolves and downloads the compromised package version.
Malicious lifecycle code may execute during installation, or malicious runtime code may execute when scripts/search.js loads Axios.
The compromised code then operates with the permissions of the installing or executing user and may access process da
...[truncated 685 chars]
Remediation
View remediation
Remediation Suggestions
Pin Axios to a reviewed exact version instead of using a caret range:
json
"axios": "1.6.0"
Prefer the latest security-supported version after compatibility and vulnerability review.
Generate and commit a package-lock.json containing resolved versions and integrity hashes.
Update installation documentation to use npm ci rather than npm install, ensuring that installation fails if the manifest and lockfile differ.
Review dependency updates through controlled pull requests and inspect lockfile changes before merging.
Run dependency vulnerability and provenance checks in CI, such as npm audit and appropriate software-composition-analysis tooling.
Where compatible with deployment requirements, install with lifecycle scripts disabled:
bash
npm ci --ignore-scripts
Execute installation and the Skill under a dedicated, least-privileged account or sandbox with restricted filesystem and network access.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares use of an environment-provided secret but does not define an explicit tool scope such as allowed tools or permissions. In practice, this can let the hosting agent infer or grant broader execution capability than intended, increasing the chance of unintended command execution or secret-adjacent access paths.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The description contains very broad trigger phrases like '查一下', '搜一下', '最近', '今天', and '今年', which are common in ordinary conversation and may cause over-triggering. This can make the skill activate in contexts where web access is unnecessary, exposing user queries to an external API and expanding the skill's effective reach beyond clear user intent.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The '何时使用' section lists ambiguous activation phrases and broad categories that overlap heavily with normal chat, making accidental invocation likely. In a skill that performs real-time external retrieval, this broad matching increases privacy and data-minimization risk because more user content may be sent to Baidu than users expect.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
This code returns user-visible error messages in Chinese, such as the empty-query and missing-api-key responses, but does not provide any opt-in or alternative locale handling. That creates a natural-language policy issue if skills are expected not to force a specific language without user choice.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The service-unavailable and troubleshooting messages are also emitted only in Chinese. Because the file contains multiple enforced Chinese-only outputs and no language selection mechanism, it violates the stated language/locale policy criterion.
Content
No source excerpt is available for this finding.
Unpinned Dependencies
Low
Category
Supply Chain
Confidence
93% confidence
Finding
The dependency is specified with a caret range (^1.6.0) rather than an exact pinned version, which allows different installs to resolve to different axios releases over time. This weakens build reproducibility and can unintentionally pull in a newly vulnerable or incompatible version through normal installs.
Content
Scanner excerpt · package.json (reported line 6)May include surrounding context.
Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
Category
Supply Chain
Confidence
84% confidence
Finding
The manifest references axios without an exact version pin, while the package has multiple published advisories across releases. Because the allowed version range is not fixed, it is not possible to verify from this file alone whether deployments will consistently avoid vulnerable axios versions, increasing supply-chain and dependency risk.
