Baidu Smart Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:18 AM UTC
• Version: 0.1.1

Overview

This is a Baidu Qianfan search wrapper, but its script can send the user's API key to an arbitrary URL if invoked with the --url option.

Review before installing. Use only with a Qianfan API key you are comfortable exposing to this wrapper, avoid passing keys on the command line, and do not let prompts or untrusted automation supply --url. The publisher should remove --url or strictly allowlist the exact Qianfan HTTPS endpoint before this is treated as a routine install.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/qianfan_search.py:34

Finding

Qianfan API Key Disclosure Through a Caller-Controlled Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'req' from os.environ.get (line 50, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/qianfan_search.py (reported line 61)May include surrounding context.

python

)

    try:
        with request.urlopen(req, timeout=30) as resp:
            body = resp.read().decode("utf-8", errors="replace")
    except error.HTTPError as e:
        detail = e.read().decode("utf-8", errors="replace")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash

set -a
source ./.env.local
set +a

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- Never place the real API key in `SKILL.md` or `references/`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The quick-start and common-pattern examples consistently prescribe Chinese query text such as "北京有哪些旅游景区" and "百度千帆平台", which can signal a language expectation to users. The file does not explicitly say the skill supports multiple languages or that Chinese is required due to a documented regional/compliance constraint, so this may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Although the skill is described as a dedicated Baidu/Qianfan search wrapper, it accepts a user-supplied --url and will POST the full payload plus the X-Appbuilder-Authorization bearer token to any destination. That expands the tool into a generic authenticated HTTP client and can leak the AppBuilder credential to attacker-controlled infrastructure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

User-controlled endpoint selection gives this narrowly scoped search skill broader outbound network capability than its declared purpose justifies. In agent environments, this can be abused to make arbitrary POST requests containing attacker-influenced content and potentially sensitive data, increasing SSRF-style and exfiltration risk even if the script is not a fully general HTTP client.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs an HTTP POST to the Baidu Qianfan search API containing the user's query and optional site filters. While the script name and argument parser imply web search behavior, there is no explicit user-facing warning, confirmation, or comment in the file that the provided query will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.