Realtime Web Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:16 AM UTC
• Version: 1.0.1

Overview

This is a real Baidu web-search skill, but it gives a Baidu bearer key to environment-configured endpoints without validating the destination.

Review before installing. Use this only with a scoped Baidu search credential, avoid sensitive queries, do not set endpoint override environment variables unless you fully trust the destination, and be aware that queries may appear in process output or collected logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search.py:13

Finding

Unrestricted Endpoint Overrides Can Expose the Baidu Bearer Credential and Search Queries

Content

View full analysis

Vulnerability Details

File Location: scripts/search.py, lines 13–19, 78–87, 102–112, and 126–129
Vulnerability Type: Unvalidated credential-bearing network destination
Risk Level: High

Vulnerable Code

python

def _post_json(url, api_key, request_body):
    headers = {
        "Authorization": f"Bearer {api_key}",
        "X-Appbuilder-From": "openclaw",
        "Content-Type": "application/json",
    }
    resp = requests.post(url, json=request_body, headers=headers, timeout=30)

python

def _search_chain_urls():
    # Baidu updates may cause chat and web_search to return equivalent references.
    # Prefer web_search and retain chat as a compatibility fallback.
    web_url = os.getenv("BAIDU_WEB_SEARCH_ENDPOINT", DEFAULT_WEB_SEARCH_URL)
    chat_url = os.getenv("BAIDU_CHAT_SEARCH_ENDPOINT", DEFAULT_CHAT_URL)

    urls = [("web_search", web_url)]
    if chat_url and chat_url != web_url:
        urls.append(("chat", chat_url))
    return urls

python

def _run_summary_last_chain(api_key, request_body):
    summary_url = os.getenv("BAIDU_SUMMARY_ENDPOINT", DEFAULT_SUMMARY_URL)

    errors = []
    try:
        return _run_search_chain(api_key, request_body)
    except Exception as e:
        errors.append(str(e))

    try:
        return _run_endpoint(summary_url, api_key, request_body, "web_summary")

python

if mode == "summary":
    summary_url = os.getenv("BAIDU_SUMMARY_ENDPOINT", DEFAULT_SUMMARY_URL)
    return _run_endpoint(summary_url, api_key, request_body, "web_summary")

Technical Analysis

The Skill obtains endpoint URLs from BAIDU_WEB_SEARCH_ENDPOINT, BAIDU_CHAT_SEARCH_ENDPOINT, and BAIDU_SUMMARY_ENDPOINT without validating their scheme, hostname, port, or trust boundary. _post_json then attaches the BAIDU_API_KEY as an HTTP Bearer credential to whichever URL was selected.

Consequently, a configured endpoin ...[truncated 2284 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer fixed service endpoints. Remove endpoint overrides if they are not essential to the Skill's declared functionality.

2. Enforce HTTPS and an explicit hostname allowlist. Before attaching the credential, parse the URL and require:

   • The https scheme.
   • An approved Baidu hostname, such as the exact expected qianfan.baidubce.com host.
   • No embedded username or password.
   • No unexpected port.
   • No IP-literal destination.
   • An expected API path or a narrowly defined path prefix.

3. Bind credentials to trusted destinations. Never attach Authorization when the validated destination is outside the approved Baidu trust boundary.

4. Control redirects. Disable automatic redirects with allow_redirects=False, or validate every redirect destination before resending a request. Ensure authorization headers cannot be forwarded to an unapproved host.

5. Fail closed. Reject invalid endpoint settings with a clear configuration error rather than silently using or contacting an arbitrary destination.

6. Separate development overrides. If custom endpoints are required for testing, require an explicit development-only switch and a separate non-production credential. Do not enable arbitrary overrides in normal operation.

7. Protect query confidentiality. Avoid printing complete parsed requests by default because user queries may contain sensitive information. Use opt-in debug logging with appropriate redaction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network-dependent behavior but does not define an explicit tool scope such as allowed tools or permissions. That ambiguity can let an agent invoke the skill more broadly than intended, increasing the chance of unintended network access or use of sensitive environment-backed credentials during routine requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad, including common expressions like 查一下, 搜一下, 最新消息, and 实时信息, which are likely to appear in many benign conversations. This can cause over-invocation of a networked skill, sending user queries to external services when a local answer would suffice, with privacy and data-exposure implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 18)May include surrounding context.

python

"X-Appbuilder-From": "openclaw",
        "Content-Type": "application/json",
    }
    resp = requests.post(url, json=request_body, headers=headers, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    if data.get("code"):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends request_body, which includes the user's query content, to remote Baidu search endpoints via requests.post. While the code prints parse/debug information and validates inputs, it does not provide a user-facing warning or comment/docstring disclosing that user-supplied content will be sent to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The common use cases emphasize broad retrieval scenarios but provide limited boundary-setting and few negative examples, making the invocation scope underspecified. In a network-enabled skill, that increases the risk of accidental use for inappropriate or unnecessary queries, though the presence of some 'Not the best fit' guidance reduces severity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script logs the full parsed request body to stdout, which includes the user query and may also include other search parameters. In many deployments stdout is centrally collected and retained, so sensitive prompts, personal data, or investigative queries could be exposed to operators, log processors, or anyone with log access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.