Is baidu-baike-data safe?
Use with caution. baidu-baike-data is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave baidu-baike-data a trust score of 68/100 with 5 findings, none critical or high.
https://clawhub.ai/ide-rea/baidu-baike-data
Is baidu-baike-data safe to install?
This skill is an empty shell — it contains no SKILL.md, no source code, and no functionality despite its name 'baidu-baike-data' implying Baidu encyclopedia data access. The only file is a .clawhub/lock.json referencing 'academic-research-hub'. While it poses no immediate technical threat (clean monitoring, intact canaries, no code execution), the deceptive naming and complete absence of content suggest either an abandoned placeholder or a name-squatting skill that could be updated with malicious content later.
What security issues were found in baidu-baike-data?
Category Scores
Findings (5)
MEDIUM Empty SKILL.md — no skill definition -30 ▶
The SKILL.md file is completely empty. This means the skill provides zero functionality to the agent. An empty skill definition is suspicious because: (1) it could be a placeholder designed to claim a skill name for later malicious updates, (2) the skill name 'baidu-baike-data' implies data retrieval functionality that does not exist, creating a false expectation, (3) users may trust the skill based on its name alone without realizing it contains nothing.
LOW No code to evaluate for exfiltration risks -15 ▶
With no source code, there are no current exfiltration vectors. However, the absence of code means there is nothing to audit — future updates could introduce exfiltration without the user re-auditing.
LOW No executable content present -20 ▶
The skill contains no executable code. The only file is a JSON lock manifest. While this means no current execution risk, it also means the skill is non-functional.
INFO Clean clone with no suspicious activity -5 ▶
The installation process showed no network connections, no process spawning, and no filesystem changes beyond the expected skill directory.
MEDIUM Deceptive naming — skill name implies functionality that does not exist -70 ▶
The skill is named 'baidu-baike-data' which strongly implies it provides Baidu Baike (Chinese encyclopedia) data retrieval capabilities. The lock.json references 'academic-research-hub'. In reality, the skill contains absolutely no functionality. This mismatch between name and content is a red flag for either: (1) an abandoned/broken skill squatting on a useful name, or (2) a placeholder that could be weaponized via future updates. Users searching for Baidu Baike integration would install this expecting functionality and get nothing.
Should I install baidu-baike-data?
Oathe's verdict for baidu-baike-data is CAUTION with a trust score of 68/100. Recommendation: Review before install.