Baidu Qianfan Tools

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:51 AM UTC
• Version: 1.1.0

Overview

This skill is a straightforward Baidu Qianfan API toolbox, with expected remote API use and no evidence of hidden execution, persistence, or unrelated data access.

Install only if you are comfortable sending the text, search terms, document/image URLs, and generated-content requests you provide to Baidu Qianfan services using your BAIDU_API_KEY. Avoid using it with secrets, regulated personal data, or confidential internal documents unless that transfer is approved. Pinning axios and adding a lockfile would improve supply-chain reproducibility.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises OCR, search, chat, image, PPT, and academic features that necessarily send user prompts, search queries, image URLs, or OCR content to Baidu APIs, but it does not clearly warn users that their supplied content may leave the local environment. This creates a privacy and data-handling risk, especially if users submit sensitive documents, images, or confidential search material under the assumption processing is local.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description is overly broad and only states that the skill integrates multiple Baidu Qianfan APIs, without defining when it should activate, what operations it performs, or any safety boundaries. Broad metadata can cause over-invocation or misuse by an agent, increasing the chance that the skill is selected in contexts involving search, generation, or external API access where the user did not intend it.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill returns a Chinese-only message to the user when the API key is missing, which forces a specific language without offering a locale choice. This is a natural-language policy concern because the file does not indicate that the skill is intentionally region-specific or that users can opt into this language.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code sends the user's query content in the request body to a remote search API using axios, which is a network operation that transmits user-provided data. In this file there is no confirmation prompt, warning comment, or user-facing disclosure that the query will be sent to an external service.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This error string is presented in Chinese only, with no indication that the user can select a preferred language. Absent documentation that the skill is intentionally region-specific, this forces a locale choice and may violate language policy expectations.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The failure message is emitted only in Chinese, with no user opt-in or alternative locale. This constitutes a natural-language policy issue unless the skill is explicitly documented as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The empty-query validation message is displayed only in Chinese, forcing a language choice on all users. The file does not provide any opt-in, fallback, or justification for a Chinese-only interface.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill sends the user-provided query to external API endpoints and includes a bearer token in the request headers. In this file there is no confirmation prompt, logging, or comment/docstring warning the user that their input will be transmitted to a remote service.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill returns user-facing status and error text only in Chinese, which forces a specific language without offering user choice. The policy calls for flagging language or locale constraints unless they are optional or clearly justified as region-specific.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code transmits the user's prompt to an external service and includes a bearer API key, but there is no confirmation prompt, visible user-facing warning, or explanatory comment/docstring disclosing that data is sent off-box. For a code file, network transmission of user or system data should have some explicit disclosure unless clearly documented elsewhere in skill markdown, which is not present in this file.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The alternate endpoint sends the same prompt data and bearer token to another remote API path, but the code provides no confirmation, print/log notice, or explanatory comment about this transmission. This is a separate safety-relevant network operation lacking disclosure within the file.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This code posts the user's prompt to an external continuation API and includes a bearer token from the environment, which is a privacy- and credential-sensitive operation. The file has no confirmation prompt, no user-facing disclosure before transmission, and no comments/docstring warning that input text will be sent to a remote service.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file’s natural-language description is entirely in Chinese, and the CLI usage and example messages also assume Chinese input/output. Under the policy rule, a skill should not force a specific language or locale unless it offers opt-in or clearly documents a justified locale constraint.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code sends a user-provided image URL to a remote OCR service and includes an Authorization bearer token, which is a safety-relevant network operation. While the script has usage/error output, there is no user-facing disclosure, comment, or prompt at the point of transmission explaining that input data will be sent to an external service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill sends the user-provided topic to a remote PPT generation API and includes an Authorization bearer token in the request headers. While this network behavior is central to the skill, the file contains no user-facing print, comment, or other disclosure indicating that input is transmitted to an external service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function reads a sensitive credential from the BAIDU_API_KEY environment variable and falls back to reading apiKey from config.json. Although comments describe the lookup order for developers, there is no user-facing warning, confirmation, or visible disclosure in this file about accessing credentials from environment variables or local files.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The file presents content in Chinese and English, but examples, notes, and primary usage text are largely oriented around Chinese-language phrasing. This may amount to an implicit language preference without an explicit opt-in or statement that users may interact in their preferred language.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The description string is written entirely in Chinese and presents the skill as localized for a specific language/locale, with no indication that users can choose another language or that the locale restriction is intentional and justified. Under the stated policy, language-specific constraints should be optional or explicitly documented.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "寇助理",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  }
}

• Confidence: 90% confidence
• Finding: Using a caret range for axios allows future compatible releases to be installed without explicit review, which can introduce supply-chain risk or unintentionally pull in a vulnerable version. In a tool package that depends on external HTTP functionality, this weakens reproducibility and makes downstream security posture less predictable.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest references axios without pinning an exact version, and axios has multiple known advisories across versions; this makes it impossible to verify from this file alone whether installation will resolve to a safe release. Because this skill integrates remote APIs, a vulnerable HTTP client could increase exposure to SSRF, MITM-related manipulation, or other request-handling weaknesses depending on runtime usage.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: User-facing messages in this file are presented only in Chinese, such as the missing API key notice, usage text, and error strings. This can violate a language/locale policy when the skill forces a specific language without giving the user an option to choose or documenting that the skill is intentionally locale-specific.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This code posts the user's search query to a remote academic search API and includes a bearer token for authentication. While the network call is central to the skill's purpose, this file provides no explicit user-facing warning, log, or comment disclosing that user input is transmitted to an external service.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: User-facing strings such as error and status messages are written only in Chinese, with no mechanism for locale selection or fallback. This can violate language-choice policy when the skill is used in broader contexts without explicit user opt-in to Chinese-only output.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Natural-language strings in the file, including the description and all user-visible error/help messages, are written only in Chinese. There is no indication that the skill is region-specific or that users can opt into another language, which can violate a language/locale choice policy.

Static analysis

No suspicious patterns detected.