ClawHub
Back to skill

Security audit

pidrive

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud-storage mount, but it relies on an unpinned third-party CLI and encourages broad remote persistence of files through normal shell commands.

Install only if you trust the pidrive publisher and are comfortable with files being stored, indexed, shared, and recovered through an external S3-backed service. Use it only for data you intentionally want persisted remotely, avoid secrets and regulated data unless you have a separate approval path, prefer private direct shares over public links, and verify the CLI release provenance before installing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding
Unpinned Third-Party Executable Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11-18 **Vulnerability Type**: Unpinned and insufficiently authenticated third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```text Install via Homebrew (recommended): brew tap abhishek203/pidrive brew install pidrive Or download directly from GitHub releases: https://github.com/abhishek203/pi-drive/releases ``` ### Technical Analysis The installation instructions direct users to install an executable from a personal GitHub repository and Homebrew tap without specifying an immutable version, commit, artifact URL, trusted signing key, or independently published expected checksum. Although the document states elsewhere that Homebrew verifies SHA-256 checksums, this does not fully establish artifact authenticity when the same third-party tap can control both the package URL and the expected checksum in its formula. An attacker who compromises the repository, release process, or tap could publish a malicious binary and update the formula with a matching checksum. The project contains only `SKILL.md`; therefore, the source code, release workflow, Homebrew formula, binary behavior, and claimed security controls cannot be verified within the audited artifact. This is a supply-chain weakness rather than evidence that the current external package is malicious. ### Attack Path 1. An attacker compromises the referenced GitHub repository, release account, Homebrew tap, or associated publishing credentials. 2. The attacker publishes a modified `pidrive` binary containing malicious behavior. 3. If necessary, the attacker updates the third-party Homebrew formula with the malicious artifact URL and corresponding checksum. 4. A user or AI agent follows the documented `brew tap` and `brew install` instructions, or downloads the unpinned release directly. 5. The malicious binary executes with the privileges of the installing or invoking user. 6. It may access data ...[truncated 754 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to a reviewed, immutable release version rather than the latest state of a mutable tap or release page. 2. Provide the exact artifact URL and expected SHA-256 or stronger cryptographic digest for each supported platform. 3. Sign release artifacts and document signature verification using a trusted public key distributed independently of the release repository. 4. Pin the Homebrew tap or formula to a reviewed commit and ensure formula changes require protected reviews and signed commits. 5. Publish reproducible build instructions so users can verify that release binaries correspond to reviewed source code. 6. Use least-privileged CI credentials, protected release environments, mandatory multi-factor authentication, and branch protection for the source and tap repositories. 7. Include or vendor the auditable source and relevant installation metadata in the reviewed Skill package where practical. 8. Advise users not to execute downloaded artifacts until checksum or signature verification succeeds. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is broadly framed as general-purpose private storage for AI agents without clear activation boundaries or task constraints. In agent environments, this can cause over-invocation and normalize remote persistence for arbitrary files, increasing the chance that sensitive local data is copied to external infrastructure without explicit user intent.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
On Linux, davfs2 is also needed for WebDAV mount support:

  sudo apt install davfs2

macOS has WebDAV built in — nothing extra needed.
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples show ordinary shell commands like echo, cp, cat, and grep against the mounted drive but do not prominently warn that operations under /drive/my/ write to remote persistent storage backed by S3. This is dangerous because users or agents may interpret these as local filesystem operations and unintentionally upload sensitive files or logs to an external service.

Session Persistence

Medium
Category
Rogue Agent
Content
ls /drive/shared/alice@company.com/
cat /drive/shared/alice@company.com/report.txt

Every read/write goes through WebDAV over HTTPS (TLS encrypted in transit) to the server, then to S3. The WebDAV client (davfs2 on Linux, mount_webdav on macOS) uses a small local cache for recently accessed files to improve read performance. The cache is temporary and cleared on unmount. All persistent data lives in S3. If the VM dies, nothing is lost.

## Share
Confidence
90% confidence
Finding
The skill explicitly states that all persistent data is stored in S3 and that a local cache of recently accessed files exists until unmount. This creates session persistence and residual data risk: sensitive material can survive VM restarts remotely, and local cached content may remain accessible longer than users expect if unmount does not occur cleanly or if host behavior differs from documentation.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The statement that any agent that can run unix commands can use the skill makes the trigger scope effectively universal. In autonomous systems this encourages use across unrelated tasks, raising the risk of unnecessary data exposure, accidental uploads, and reliance on a third-party storage path when local-only handling would be safer.

Static analysis

No suspicious patterns detected.