The Baidu search skill is vulnerable to
Claims to do
Baidu Search: Search the web via Baidu AI Search API.
Actually does
This skill executes a Python script (`skills/baidu-search/scripts/search.py`) using `python3`. It requires a `BAIDU_API_KEY` environment variable for authentication and sends a JSON payload containing a search query, optional result count, and freshness parameters to an unspecified Baidu AI Search API endpoint.
openclaw skills install ide-rea/baidu-searchThe skill executes a Python script with a user-provided JSON string. The 'query' field within this JSON is a string that, if not properly sanitized by the Python script, could lead to command injection if the script internally uses it in a shell command.
python3 skills/baidu-search/scripts/search.py '<JSON>' query | str | yes | - | Search query
[](https://mondoo.com/ai-agent-security/skills/clawhub/ide-rea/baidu-search)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/ide-rea/baidu-search"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/ide-rea/baidu-search.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/ide-rea/baidu-search.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.