中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
baidu-web-search
Use Baidu Qianfan web search API for real-time web retrieval
A legitimate Baidu Qianfan web search skill with clean code and strong API key protection documentation, but with minor documentation gaps and an unpinned dependency.
Skill Namebaidu-web-search
Duration36.7s
Enginepi
✓
Safe to install
Pin axios to an exact version (e.g., 1.7.7) in package.json to prevent supply chain risk, and add an explicit 'allowed-tools' declaration in SKILL.md metadata for transparency.

Findings 2 items

Severity Finding Location
Low
Allowed tools not explicitly declared in metadata Doc Mismatch
SKILL.md describes execution of 'node scripts/search.js' in prose but does not declare shell:WRITE or network:WRITE in the openclaw metadata block, creating a gap between documented and actual resource usage.
openclaw: {"requires": {"env": ["BAIDU_API_KEY"]}}
→ Add allowed-tools declaration to SKILL.md metadata: openclaw.requires.allowedTools: ['Bash', 'Read']
 SKILL.md:9
Low
axios dependency uses loose version constraint Supply Chain
package.json specifies axios: '^1.6.0', allowing any 1.x.y version to be installed. This enables supply chain drift where a future minor release could introduce malicious behavior.
"axios": "^1.6.0"
→ Pin to exact version: "axios": "1.7.7" and consider adding package-lock.json to the repo
 package.json:4
ResourceDeclaredInferredStatusEvidence
Shell NONE WRITE ✓ Aligned SKILL.md only describes 'node scripts/search.js' execution in prose without an e…
Filesystem NONE READ ✓ Aligned scripts/search.js:13-18 reads config.json via fs.readFileSync
Network NONE WRITE ✓ Aligned scripts/search.js:7 POSTs to https://qianfan.baidubce.com/v2/ai_search/web_searc…
4 findings
🔗
Medium External URL 外部 URL
https://leiaibot.com
SKILL.md:7
🔗
Medium External URL 外部 URL
https://cloud.baidu.com/doc/qianfan-api/s/Wmbq4z7e5
SKILL.md:80
🔗
Medium External URL 外部 URL
https://qianfan.baidubce.com/v2/ai_search/web_search
scripts/search.js:7
📧
Info Email 邮箱地址
[email protected]
SKILL.md:6

File Tree

5 files · 9.4 KB · 242 lines
Markdown 1f · 130L JavaScript 1f · 96L JSON 3f · 16L
├─ ▾ 📁 scripts
│ └─ 📜 search.js JavaScript 96L · 2.7 KB
├─ 📋 _meta.json JSON 5L · 135 B
├─ 📋 config.example.json JSON 3L · 19 B
├─ 📋 package.json JSON 8L · 121 B
└─ 📝 SKILL.md Markdown 130L · 6.4 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
axios ^1.6.0 npm No Version not pinned — allows any 1.x.y minor/patch release

Security Positives

✓ Clean, readable code with no obfuscation or suspicious patterns
✓ Strong API key protection documentation with explicit do-not-read/do-not-output rules
✓ API key scoped to a single, well-defined purpose (Baidu search only)
✓ No credential harvesting, data exfiltration, or hidden functionality
✓ Outputs only generic error messages, never exposing configuration or API key values
✓ Timeout set on HTTP requests (15s) preventing resource exhaustion
✓ No shell injection vulnerabilities — all user input used as structured arguments only
✓ gitignore excludes config.json to prevent accidental credential commits