baidu-search-CLI

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Baidu search helper that uses a Baidu API key and a curl request to a Baidu endpoint, with no evidence of hidden or unrelated behavior.

Before installing, make sure you are comfortable letting the skill use BAIDU_API_KEY to send search requests to Baidu, and review the included search_request.json so it contains the query you want.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your Baidu API key to make search API requests, which may affect quota or billing depending on your Baidu account.

Why it was flagged

The skill requires a Baidu API key as its primary credential, which is expected for using Baidu's search API but is still account-linked access.

Skill content

requires": { "bins": ["shell"], "env":["BAIDU_API_KEY"]},"primaryEnv":"BAIDU_API_KEY"

Recommendation

Use a dedicated or limited Baidu API key if possible, and confirm the key is only used for this Baidu search endpoint.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The agent may make network requests to Baidu using the provided request JSON and API key.

Why it was flagged

The skill directs the agent to run a shell curl command, but the command is specific to the declared Baidu search API workflow.

Skill content

curl -X POST -H "Authorization: Bearer apikey" -H "X-Appbuilder-From: openclaw" -H "Content-Type: application/json" -d "@search_request.json" "https://qianfan.baidubce.com/v2/ai_search/web_search"

Recommendation

Review or edit search_request.json before use so the query and date filters match what you intend to send.