Baidu Baike Data 1.1.0

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:38 PM UTC
• Version:
  1.0.0

Overview

This is a straightforward Baidu Baike lookup skill that discloses its Baidu API key requirement and uses it for the advertised encyclopedia searches.

Install only if you are comfortable providing a Baidu API key and sending lookup terms to Baidu's API. Use a scoped key where possible, avoid placing it in shared logs, and ensure the runtime has the Python requests package available.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill requires access to an environment variable containing an API key and performs network-based lookups, but it does not explicitly declare permissions for those capabilities. Undeclared sensitive capabilities reduce transparency and can bypass review expectations, making it easier for a skill to exfiltrate secrets or make unintended external requests if the implementation changes or is compromised.

VirusTotal

65/65 vendors flagged this skill as clean.