Openclaw Cn 百度搜索

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Baidu search proxy, but it needs review because one startup path can expose an unauthenticated API-key-backed service to the network and the app logs user queries.

Install only if you are comfortable running a local Baidu API proxy. Keep it bound to 127.0.0.1, do not run the module's direct __main__ path unless the bind address is fixed, protect the .env file, avoid searching for secrets or sensitive personal data, and prefer a locked dependency install before using it in a shared or production environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/baidu_search/main.py:57

Finding

Unauthenticated Search Proxy Binds to All Network Interfaces

Content

View full analysis

SearchResponse: """ 搜索网页 - **query**: 搜索关键词 - **top_k**: 返回结果数量 (1-20, 默认 10) - **recency_filter**: 时间过滤 (day, week, month, year) - **site_filter**: 限定搜索的网站列表 """ return search(request) ``` ### Technical Analysis When the module is started directly, Uvicorn listens on `0.0.0.0`, making the API reachable through every network interface permitted by the host firewall. This behavior differs from the loopback-only startup commands documented in `SKILL.md`. The `/search` route does not require a token, session, client certificate, or other authorization mechanism. Every accepted request is forwarded to Baidu using the server operator's `BAIDU_API_KEY`. Consequently, any network client that can reach port 8001 can consume the privileged third-party API integration. Request validation limits `top_k` but does not prevent repeated requests, and the application implements no rate limiting or usage quotas. ### Attack Path 1. An operator starts the application directly with `python -m baidu_search.main` or otherwise executes its `__main__` block. 2. Uvicorn binds port 8001 to every available network interface. 3. An attacker discovers the reachable service through network scanning or prior knowledge. 4. The attacker repeatedly sends valid `POST /search` requests without credentials. 5. The server attaches its private Baidu API key to each upstream request. 6. The attacker consumes the operator's API quota and can ...[truncated 631 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/baidu_search/baidu_api.py:106

Finding

Sensitive Search Queries and Invalid Request Bodies Are Written to Logs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:7

Finding

Unpinned Dependencies Allow Non-Reproducible Package Resolution

Content

View full analysis

=0.110.0", "httpx>=0.27.0", "uvicorn[standard]>=0.29.0", ] ``` The build dependency is also not pinned: ```toml requires = ["hatchling"] ``` The documented setup resolves dependencies dynamically, including optional development dependencies: ```bash cd {baseDir} echo "BAIDU_API_KEY=your-api-key" > .env uv venv && uv pip install -e ".[dev]" uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001 ``` ### Technical Analysis The project has no reviewed lock file or package hashes in the audited directory. Constraints such as `fastapi>=0.110.0` permit the package manager to select any later compatible release available from the configured package index at installation time. The same issue applies to transitive dependencies and the unpinned build backend. As a result, two installations performed at different times may install different code. If an allowed dependency release is compromised, malicious, or newly vulnerable, the installation can introduce it without any source change in this project. Installing the `dev` extra during normal setup unnecessarily expands the dependency graph by adding packages that are not required to run the service. The audit found no evidence that the currently named packages are typosquatted or malicious. The finding concerns the absence of reproducible, integrity-controlled resolution. ### Attack Path 1. A direct or transitive dependency publishes a compromised release that satisfies the open-ended version constraint, or the configured package index is compromised. 2. An operator follows the documented setup command at a later date. 3. `uv pip install -e ".[ ...[truncated 1111 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash

cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

bash

cd {baseDir}
echo "BAIDU_API_KEY=your-api-key" > .env
uv venv && uv pip install -e ".[dev]"
uv run --env-file .env uvicorn baidu_search.main:app --host 127.0.0.1 --port 8001

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares it needs an API key and performs web searches via a local HTTP service, but it does not define any explicit permission or allowed-tool scope. That makes the network and environment access implicit rather than auditable, increasing the chance that an agent or operator grants broader capabilities than intended.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

3. 带时间过滤的搜索:

bash

curl -X POST http://127.0.0.1:8001/search \
  -H "Content-Type: application/json" \
  -d '{
    "query": "最新科技新闻",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API title and description are explicitly Chinese-language only ("百度搜索 API", "百度 AI 搜索代理服务"), and the endpoint docstrings are also only in Chinese. This indicates a fixed language/locale presentation without any visible opt-in, alternative language support, or justification that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup instructions create a .env file containing a live API credential but do not warn users to protect it, avoid committing it, or restrict file permissions. This can lead to accidental secret exposure through source control, logs, backups, or shared workspaces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language description is written only in Chinese ("百度 AI 搜索 API 代理服务"), which can impose a language choice on users without indicating any opt-in or multilingual support. This matches the policy category for language or locale constraints expressed in natural-language metadata.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The only natural-language description is the Chinese string '百度搜索 API 代理服务', which presents the skill solely in one language. Under the policy, language-specific behavior or presentation should be documented as optional or justified; no opt-in or region-specific justification appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This file uses Chinese-only natural-language docstrings and comments such as '获取百度 API Key' and '执行百度搜索'. Per the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy concern, and no locale choice or region-specific rationale is documented in the file.

Content

No source excerpt is available for this finding.