Qianfan Usage

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:18 PM UTC
• Version: 1.0.2

Overview

This skill does what it claims, but it saves and reuses Baidu login cookies in ways that need careful review before installation.

Install only if you are comfortable with this skill storing reusable Baidu session data locally and sending selected cookies to Baidu's Qianfan quota endpoint. Use it on a trusted single-user machine, protect or delete ~/.baidu-qianfan-auth.json when finished, and review the agent-browser dependency before relying on automatic login.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: qianfan_usage.py:93

Finding

Overbroad Baidu Cookie Selection and Replay

Content

View full analysis

Vulnerability Details

File Location: qianfan_usage.py:93-113
Additional Locations: qianfan.py:26-42, check_quota_v2.py:37-76
Vulnerability Type: Excessive credential scope and exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

def build_cookie_string(cookies):
    parts = []
    for c in cookies:
        if 'baidu.com' in c.get('domain', ''):
            parts.append(f"{c['name']}={c['value']}")
    return '; '.join(parts)

def query_with_curl(cookies):
    cookie_str = build_cookie_string(cookies)
    
    cmd = [
        'curl', '-s', '-L', API_URL,
        '-H', f'Cookie: {cookie_str}',
        '-H', 'Referer: https://console.bce.baidu.com/qianfan/resource/subscribe',
        '-H', 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36',
        '--max-time', '10'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout if result.returncode == 0 else None

An analogous implementation appears in qianfan.py. The implementation in check_quota_v2.py uses a list containing console.bce.baidu.com, bce.baidu.com, and baidu.com, but still performs substring-based matching.

Technical Analysis

The code selects every cookie whose domain contains the string baidu.com, combines the selected values into one header, and sends that header to the Qianfan console endpoint. This is broader than the minimum authorization scope required to retrieve quota information.

Substring matching is not equivalent to RFC-compliant cookie-domain validation. It may select cookies for unrelated Baidu services and can also match a domain such as notbaidu.com. Manually combining cookies also bypasses normal browser or cookie-jar enforcement of domain, path, expiration, and secure transport constraints.

The complete cookie header is additionally supplied as a curl command-line arg ...[truncated 1407 chars]

Remediation

View remediation

Remediation Suggestions

• Replace manual cookie-header construction with an HTTP client that uses an RFC-compliant cookie jar.
• Allowlist the exact cookie names required by the quota endpoint rather than accepting every cookie for the provider.
• Require exact or standards-compliant domain matching for console.bce.baidu.com; do not use substring matching.
• Enforce cookie path, expiration, and secure transport restrictions.
• Avoid placing session cookies in process arguments. Send the request through an in-process HTTPS library or a protected temporary configuration mechanism.
• Validate the destination URL immediately before attaching credentials and disable redirects to untrusted hosts.
• Remove expired and unrelated cookies from previously stored authentication state.

T09 · Insecure Skill Coding Practices

Warning

• Location: qianfan_usage.py:70

Finding

Complete Browser Authentication State Stored Without Enforced File Protection

Content

View full analysis

Vulnerability Details

File Location: qianfan_usage.py:15,70-73
Related Usage: qianfan_usage.py:231-233
Vulnerability Type: Plaintext storage of reusable session credentials
Risk Level: Medium

Vulnerable Code

python

AUTH_FILE = os.path.expanduser("~/.baidu-qianfan-auth.json")

python

def save_auth():
    stdout, stderr, code = run_browser(['state', 'save', AUTH_FILE])
    return code == 0

Technical Analysis

After a successful login, the program asks agent-browser to save the complete browser state to a predictable JSON file in the user's home directory. Browser state commonly contains reusable session cookies and may contain additional origin-specific authentication data.

The Skill does not explicitly create the file with restrictive permissions, verify its owner or mode before loading it, minimize the stored credential set, encrypt it, or establish deletion and revocation behavior. Its security therefore depends entirely on undocumented or environment-dependent behavior of the external browser tool and the user's default filesystem permissions.

Persisting authentication is related to avoiding repeated login, but saving the complete state exceeds the minimum data required if only a small set of Qianfan-specific cookies is necessary.

Attack Path

1. The user completes SMS-based authentication through the automated browser.
2. save_auth() writes the browser state to ~/.baidu-qianfan-auth.json.
3. A local process or another user with permission to read that file copies the stored cookies or tokens.
4. The actor imports or manually replays the captured session credentials.
5. The actor accesses services authorized by the captured session until the credentials expire or are revoked.

This path requires local read access to the authentication file or compromise of a process running under the same account.

Impact Assessment

A successful theft may per ...[truncated 404 chars]

Remediation

View remediation

Remediation Suggestions

• Store only the exact cookies or token required by the Qianfan quota endpoint, rather than the complete browser state.
• Create the credential file atomically with mode 0600 and reject files owned by another user or accessible to a group or other users.
• Prefer an operating-system credential manager or encrypted secret store.
• Define a short credential lifetime and delete stale browser state.
• Provide an explicit logout command that removes the local state and revokes the server-side session where supported.
• Warn users that the file contains reusable authentication credentials.
• Verify file ownership, type, and permissions before every read to mitigate symlink and replacement risks.

T08 · Insecure Dependencies

Note

• Location: _meta.json:28

Finding

Security-Sensitive Browser Automation Dependency Is Not Version-Pinned

Content

View full analysis

Vulnerability Details

File Location: _meta.json:28-31
Related Documentation: SKILL.md:56-59
Vulnerability Type: Unrestricted dependency resolution for an authentication-handling component
Risk Level: Low

Vulnerable Code

json

"dependencies": {
  "agent-browser": ">=1.0.0",
  "python3": ">=3.8"
},

Technical Analysis

The dependency declaration permits any future agent-browser version greater than or equal to 1.0.0. No lockfile, package integrity hash, or exact audited version is supplied. The Skill documentation also represents this dependency as automatically installed.

This dependency is security-sensitive because it receives the user's phone number and verification codes, controls an authenticated browser, and exports the resulting browser state. A compromised or unexpectedly modified future release would execute in a position where it could access those credentials.

The audit found no evidence that the currently intended dependency is malicious. The issue is the unsafe future resolution and upgrade policy.

Attack Path

1. The Skill is installed or updated after a newer dependency release becomes available.
2. The version constraint resolves to that newer release without requiring review of its changes.
3. If the release or its distribution channel has been compromised, its code executes when the Skill invokes agent-browser.
4. The compromised component observes login input, verification codes, browser content, and session state.
5. It may exfiltrate those credentials or alter browser actions with the privileges of the user running the Skill.

Exploitation requires compromise of the dependency, its publishing account, registry resolution, or another relevant supply-chain component.

Impact Assessment

Malicious dependency code would run with the local permissions of the Skill process and could access authentication data intentionally provided to the browser ...[truncated 253 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-browser to an exact version that has been reviewed and tested.
• Use a lockfile and verify package integrity with a cryptographic hash or signed provenance.
• Explicitly identify the trusted package registry and reject fallback resolution from untrusted sources.
• Require user confirmation before installing or upgrading the browser automation component.
• Review dependency release notes and security changes before updating the pin.
• Run browser automation with the narrowest feasible filesystem and network permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown states that the skill will automatically log in when cookies expire and will save login state to a local cookie file. Because this behavior affects authentication state and stores sensitive session data, the description should clearly warn users about the privacy and security implications rather than only presenting it as a convenience feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script loads persistent authentication cookies from a local file and automatically sends them to a remote API, effectively reusing browser-like session credentials without an explicit runtime consent or strong validation of scope. In a skill/tooling context, this increases the risk of silent credential use, unintended account access, and session leakage through logs, process inspection, or overly broad cookie selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script reads stored authentication cookies from a local file and sends them to a remote endpoint without any explicit consent prompt, warning, or scoping controls. Even though the destination appears to be the expected Baidu API, this pattern handles bearer-style session credentials in a way that can expose sensitive account access if the file is stale, overbroad, compromised, or reused in an unintended context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

With no manifest available, the skill's purpose must be treated as unknown, so invoking an external command is an unjustified capability rather than an obviously required implementation detail. The code could have used an in-process HTTP client, but instead grants the skill the ability to launch system binaries, which is broader than simple quota retrieval.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · check_quota_v2.py (reported line 82)May include surrounding context.

python

'-H', 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        return None, result.stderr

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · qianfan.py (reported line 45)May include surrounding context.

python

'-H', 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        return None, result.stderr

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · qianfan_usage.py (reported line 112)May include surrounding context.

python

'-H', 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode != 0:
        return None, result.stderr

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script saves and reuses authenticated browser state, including cookies, in a predictable file under the user's home directory without any visible warning, consent flow, or file-permission hardening. Stored session material can be reused by other local processes or users with filesystem access to impersonate the user against Baidu services.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · qianfan_usage.py (reported line 29)May include surrounding context.

python

def run_browser(args):
    """运行 agent-browser 命令"""
    result = subprocess.run(
        ['agent-browser'] + args,
        capture_output=True,
        text=True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads saved cookies and automatically sends them to a remote API via curl without clear user disclosure or confirmation. This increases the risk of silent credential reuse, and if the local auth file is compromised or the script is repurposed, authenticated requests could be made on the user's behalf without awareness.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · qianfan_usage.py (reported line 202)May include surrounding context.

python

# 勾选协议
    if '我已阅读并同意' in elements:
        from subprocess import run
        run(['agent-browser', 'check', elements['我已阅读并同意']], capture_output=True)
    
    # 点击登录
    snapshot = get_snapshot()

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation instructs users to export their phone number in an environment variable to avoid repeated input, but it does not warn that environment variables can be visible to other processes, shells, logs, or shared environments. This is a user-data/privacy concern that should be disclosed in the markdown description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 69% confidence

Finding

The natural-language instructions are entirely in Chinese and do not indicate whether another language is supported or whether the locale is intentionally constrained. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to store a personal phone number in a local environment file for automated login, but it does not clearly warn about the privacy and account-security implications of persisting this identifier. While a phone number alone is not a secret credential, storing and using it for automated authentication increases exposure of sensitive personal data and may normalize unsafe handling of account-related information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The request hard-codes Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific language/locale preference. The file does not provide user opt-in, configurability, or justification that the skill is region-specific and must use this locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.