Baidu Search Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:18 AM UTC
• Version: 1.0.1

Overview

This Baidu search alias is mostly purpose-aligned, but it runs an unbundled local script from outside the reviewed package without validation.

Install only if you trust and can verify the separate realtime-web-search script at the expected local path. Prefer installing the canonical realtime-web-search skill directly, or require this alias to bundle or cryptographically verify the script it executes.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/search.py:5

Finding

Execution of an Unverified External Script from a Predictable Temporary Path

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 5-14
Vulnerability Type: Untrusted local script execution and tool hijacking
Risk Level: High

Vulnerable Code

python

CANONICAL_SCRIPT = (
    Path(__file__).resolve().parents[3]
    / "custom-skills"
    / "realtime-web-search"
    / "scripts"
    / "search.py"
)


if __name__ == "__main__":
    runpy.run_path(str(CANONICAL_SCRIPT), run_name="__main__")

Technical Analysis

The Skill does not contain its canonical search implementation. Instead, it constructs a path outside the audited package and executes the referenced Python file using runpy.run_path.

Given the supplied project location, Path(__file__).resolve().parents[3] resolves to /tmp, making the effective target:

text

/tmp/custom-skills/realtime-web-search/scripts/search.py

This is a predictable location outside the Skill's trusted package boundary. The code performs no validation of the target's ownership, permissions, trusted root, file type, or cryptographic integrity before executing it. If another local user or process can create or replace the target file, the legitimate-looking Skill invocation will execute attacker-controlled Python code with the same privileges and environment as the invoking process.

The external implementation was not included in the audit artifact. Consequently, its network behavior, endpoint validation, request handling, and use of BAIDU_API_KEY cannot be independently verified.

Attack Path

1. An attacker gains the ability to create or replace files under the expected /tmp/custom-skills/realtime-web-search/scripts/ path.
2. The attacker places a malicious Python payload at /tmp/custom-skills/realtime-web-search/scripts/search.py.
3. A user or agent invokes scripts/search.py according to the documented workflow.
4. The wrapper resolves the predictable external path without verifying its trustwor ...[truncated 990 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the canonical search implementation within the audited Skill package and execute or import it using a path located under the package's validated root.
2. Alternatively, distribute the canonical implementation as a version-pinned, trusted Python package and import it through normal package resolution rather than executing an arbitrary filesystem path.
3. Do not load executable code from /tmp or another shared, attacker-writable location.
4. If an external script is operationally required:
   • Resolve it from an explicitly configured trusted installation directory.
   • Confirm that the resolved path remains inside that trusted directory.
   • Reject symbolic links and unexpected file types.
   • Validate file ownership and ensure the file and every parent directory are not writable by untrusted users.
   • Verify the file against a pinned cryptographic digest or authenticated signature before execution.
5. Fail closed with a clear error if the trusted implementation is absent or fails validation; do not search fallback locations.
6. Include the complete canonical implementation in future audit artifacts so its handling of credentials, endpoint overrides, network traffic, and untrusted search content can be reviewed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.