Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Baidu Baike lookup helper that uses a Baidu API key to query encyclopedia entries and print results.
Install this only if you intend to use Baidu Baike as the source and are comfortable providing a BAIDU_API_KEY. Search terms and the API key are sent to Baidu's AppBuilder Baike API when the script runs.
The documented behavior understates the skill’s real capabilities and dependencies, including lookup by internal ID, candidate enumeration, credential use, and outbound API access. When a skill’s description does not accurately reflect what it does, reviewers and users may grant it trust or execution in contexts they would otherwise restrict, which can enable data handling or network behavior outside expected bounds.
The README presents the skill exclusively as a Baidu Baike query tool and gives no indication that users can choose another language or encyclopedia source. Because Baidu Baike is a Chinese-language, locale-specific knowledge source, this can amount to a language/locale constraint that is not explicitly offered as an opt-in or justified as region-specific.
The skill declares environment-variable and network-dependent behavior but does not define an explicit tool/permission scope. This creates a transparency and policy-enforcement gap: a caller or platform may not realize the skill can access credentials and perform outbound requests, increasing the risk of unintended secret exposure or unauthorized network use.
