bailian-web-search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

This web-search skill requests broad local file and command permissions that are not clearly needed or constrained for its stated Bailian search purpose.

Install only if you are comfortable granting this skill broad local file and command capabilities. Prefer using it in a sandbox with no sensitive files, no administrator privileges, and a dedicated Bailian API key until the publisher narrows the permissions and documents exact network, file, and command boundaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:22

Finding

Excessive and Unconstrained Agent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-26; related behavior declarations at SKILL.md:66-67, SKILL.md:202, SKILL.md:209-211, and SKILL.md:224
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: High

The Skill requests broad file-system and command-execution tools:

yaml

tools:
  - read
  - exec
  - write
  - glob

It also declares that the Agent may construct API requests from user input, send HTTP requests to a target endpoint, process files, and execute system commands. The document mentions command allowlisting and sandboxing only as recommendations; it does not define or enforce an allowlist, restricted file paths, permitted command arguments, or an outbound network destination. It also suggests administrator execution as a response to permission errors.

Technical Analysis

The stated web-search function needs controlled network access to a known Bailian service. It does not inherently require unrestricted local file reads, arbitrary file writes, recursive path discovery, or general-purpose system command execution.

Granting read, write, glob, and exec together creates a broad capability chain:

1. glob can discover files available to the Agent.
2. read can access discovered files, including potentially sensitive configuration data.
3. exec can invoke system commands with the Agent process's privileges.
4. write can modify accessible files or create command inputs.
5. Network request behavior can provide a channel through which accessed information may be transmitted.

The Skill accepts a user-controlled instruction parameter but does not define strict validation or separation between search terms, command arguments, file paths, and network destinations. Although no malicious command or implemented exfiltration payload was found, the combination of user-controlled instructions and unconstrained privileged tools violat ...[truncated 1735 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, write, read, and glob unless each capability is demonstrably necessary for the web-search workflow.
2. Replace general-purpose command execution with a dedicated HTTP client tool that exposes only the required Bailian operation.
3. Define the exact official HTTPS endpoint and enforce an outbound hostname allowlist. Reject redirects to unapproved hosts.
4. Use a fixed request schema. Treat user input only as search data and never interpolate it into shell commands, headers, URLs, or file paths without strict validation.
5. If file access is required, restrict it to a dedicated workspace directory, prevent path traversal and symbolic-link escapes, and use read-only access whenever possible.
6. If command execution cannot be removed, enforce a small executable allowlist, fixed argument schemas, shell-free process invocation, timeouts, output limits, and a low-privilege sandbox.
7. Remove the recommendation to run as administrator. Fail safely when required permissions are unavailable.
8. Add explicit controls for API-key redaction, response-size limits, request timeouts, TLS verification, logging sanitization, and user confirmation before sensitive operations.
9. Document the minimum required permissions and add tests proving that unrelated files, commands, and network destinations cannot be accessed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation guidance is so broad that it overlaps with many generic AI, agent, and LLM workflows rather than a narrowly bounded web-search use case. Overbroad routing increases the likelihood that the skill is selected in inappropriate contexts, exposing powerful tools like exec/write/read where they are not needed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document claims that only whitelisted commands run in a sandbox, but it provides no whitelist and elsewhere advertises command execution generally. This creates a misleading security boundary: users or agents may trust the skill as constrained when in practice command execution scope is undefined, enabling abuse if user-controlled input reaches exec-capable paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a Bailian web-search integration, but later documentation broadens its stated behavior to file handling and command execution. This mismatch can cause an agent or user to invoke the skill in contexts far beyond its apparent purpose, increasing the chance of unsafe tool use and privilege overreach.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The quick-start instruction tells users to invoke the skill in agent conversations without defining when it should or should not be used. In a skill that declares read/write/exec tools, such ambiguity increases accidental activation and unnecessary exposure of high-risk capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.