ClawHub
Back to skill

Security audit

pidrive

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud-storage mount, but it relies on an unpinned third-party CLI and encourages broad remote persistence of files through normal shell commands.

Install only if you trust the pidrive publisher and are comfortable with files being stored, indexed, shared, and recovered through an external S3-backed service. Use it only for data you intentionally want persisted remotely, avoid secrets and regulated data unless you have a separate approval path, prefer private direct shares over public links, and verify the CLI release provenance before installing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Third-Party Executable Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description is broadly framed as general-purpose private storage for AI agents without clear activation boundaries or task constraints. In agent environments, this can cause over-invocation and normalize remote persistence for arbitrary files, increasing the chance that sensitive local data is copied to external infrastructure without explicit user intent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
On Linux, davfs2 is also needed for WebDAV mount support:

  sudo apt install davfs2

macOS has WebDAV built in — nothing extra needed.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples show ordinary shell commands like echo, cp, cat, and grep against the mounted drive but do not prominently warn that operations under /drive/my/ write to remote persistent storage backed by S3. This is dangerous because users or agents may interpret these as local filesystem operations and unintentionally upload sensitive files or logs to an external service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly states that all persistent data is stored in S3 and that a local cache of recently accessed files exists until unmount. This creates session persistence and residual data risk: sensitive material can survive VM restarts remotely, and local cached content may remain accessible longer than users expect if unmount does not occur cleanly or if host behavior differs from documentation.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
ls /drive/shared/alice@company.com/
cat /drive/shared/alice@company.com/report.txt

Every read/write goes through WebDAV over HTTPS (TLS encrypted in transit) to the server, then to S3. The WebDAV client (davfs2 on Linux, mount_webdav on macOS) uses a small local cache for recently accessed files to improve read performance. The cache is temporary and cleared on unmount. All persistent data lives in S3. If the VM dies, nothing is lost.

## Share

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The statement that any agent that can run unix commands can use the skill makes the trigger scope effectively universal. In autonomous systems this encourages use across unrelated tasks, raising the risk of unnecessary data exposure, accidental uploads, and reliance on a third-party storage path when local-only handling would be safer.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.