Agent Economy ReportAgent Economy ReportCAUTION version 1.1.4 · audited 2026-09-09
This skill is a thin wrapper around Baidu's AI Search web API. You run a small Python script with a JSON argument containing a query (plus optional result count and date-range filter), and it posts that query to https://qianfan.baidubce.com, then prints the returned search results as JSON. It reads your BAIDU_API_KEY from the environment and sends it only as a Bearer token to Baidu's own endpoint. One extra behavior: if two environment variables (DUMATE_SESSION_ID and DUMATE_SCHEDULER_URL) are set, the request is redirected to whatever URL those variables specify instead of Baidu, without the API key attached; this is labeled as a sandbox proxy path but means the destination is environment-controlled. There is no shell execution, no file writing, no persistence, no obfuscated code, and no wallet or payment logic. The main residual risk is normal for search tools: the text it returns comes from third-party web pages and may contain instructions aimed at the agent.
Instructions try to steer the agent beyond the declared purpose. scripts/search.py:120 prints raw Baidu search results (titles, URLs, and other reference fields from arbitrary web pages) to stdout, where an agent will read them; the skill does not sanitize or delimit this untrusted content. No prompt-injection or rule-overriding instructions were found in the skill's own files.
| Declared purpose | Search the web using Baidu AI Search Engine (BDSE) for live information, documentation, or research, via a Python script that takes a JSON request and prints JSON results. |
| Observed behavior | Parses a JSON argument, validates query/count/freshness, builds a Baidu AI Search request body, POSTs it to https://qianfan.baidubce.com/v2/ai_search/web_search with an Authorization Bearer header built from BAIDU_API_KEY, strips the 'snippet' field from each result, and prints the results to stdout. If DUMATE_SESSION_ID and DUMATE_SCHEDULER_URL are both set, it rewrites the request URL to that scheduler host under /api/qianfanproxy and sends the query with a session-id header and no API key. No other network calls, no subprocess execution, no file writes beyond stdout printing. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: BAIDU_API_KEY |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | HTTPS POST to https://qianfan.baidubce.com/v2/ai_search/web_search (scripts/search.py:12,15). An alternate destination can be supplied at runtime through the DUMATE_SCHEDULER_URL environment variable (scripts/search.py:32,50). |
| credentials | needed | Reads BAIDU_API_KEY from the environment and sends it only as a Bearer token to the Baidu endpoint (scripts/search.py:39,44). The key is not written to disk or sent anywhere else; in the proxy branch no key is attached. |
| other | needed | Returns third-party web search content to the agent's context (scripts/search.py:120), which is untrusted text. |
| severity | finding |
|---|---|
| low | Request destination can be redirected by an environment variable When DUMATE_SESSION_ID and DUMATE_SCHEDULER_URL are both set, the search query is sent to whatever host DUMATE_SCHEDULER_URL names instead of Baidu. This is documented in code comments as a sandbox proxy and no API key is included on that path, but it means the network destination is not fixed and anyone able to set those variables can capture search queries. No hardcoded third-party host is present. scripts/search.py:50 proxy_url = f"{scheduler_url}/api/qianfanproxy{parsed.path}" |
| info | API key used only against the declared Baidu endpoint The BAIDU_API_KEY read at line 39 is attached solely as a Bearer token on the request to https://qianfan.baidubce.com (line 12). There is no code that logs, stores, or forwards the key elsewhere. scripts/search.py:44 "Authorization": f"Bearer {api_key}", |
| low | Untrusted web content returned directly to the agent Search results from third-party pages are printed verbatim for the agent to consume. Text in those results could attempt to instruct the agent (indirect prompt injection). This is inherent to any search tool, but callers should treat the output as data, not instructions. scripts/search.py:120 print(json.dumps(results, indent=2, ensure_ascii=False)) |
| info | Instructs the user to store the API key in the OpenClaw config file Setup documentation asks the user to place the plaintext API key in ~/.openclaw/openclaw.json. This is the host tool's normal configuration mechanism and the skill itself does not read or modify that file, but the key sits in plaintext on disk. references/apikey-fetch.md:25 "BAIDU_API_KEY": "your_actual_api_key_here" |
| info | Documentation suggests restarting the host agent gateway A manual instruction in setup docs, not executed by any code in the package. No persistence mechanism or automatic command execution exists in the skill. references/apikey-fetch.md:43 openclaw gateway restart |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| console.bce.baidu.com | not in the service index | SKILL.md:17 |
| qianfan.baidubce.com | not in the service index | scripts/search.py:12 |
| Binaries invoked | bash, python, python3 |
| Environment variables read | BAIDU_API_KEY, DUMATE_SCHEDULER_URL, DUMATE_SESSION_ID |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 2 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 63 | 4fa6b504a90d14bc… |
_meta.json | 6 | 7a2d78b7f7e6ccbd… |
references/apikey-fetch.md | 58 | d1bce5a0b331eb35… |
scripts/search.py | 123 | e91c73fb570a88df… |
skill-card.md | 45 | e9e271a33ca78b83… |
For agents
JSON: https://agenteconomy.report/k/baidu-search.audit.json · badge: https://agenteconomy.report/k/baidu-search.audited.svg ·
skill rating: /k/baidu-search · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).