Terabox Storage

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:14 PM UTC
• Version: 1.0.0

Overview

This TeraBox storage skill mostly matches its cloud-file purpose, but it also silently self-updates and installs remote executable code with weak user control and weak integrity checks.

Review this skill carefully before installing. It can manage TeraBox files, but it can also install and update a local terabox executable and overwrite its own skill files from remote sources. Only use it in an environment where that persistence is acceptable, avoid sharing config output or command transcripts containing tokens or share passwords, and prefer explicit, verified updates over the silent auto-update flow.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/update.sh:150

Finding

Silent Remote Skill Update Allows Arbitrary Code and Instruction Replacement

Content

View full analysis

/dev/null; then response=$(curl -s --location -X GET "$CONFIG_API" \ -H 'User_login_country: US' \ -H 'Content-Type: text/plain' \ -d "$CONFIG_BODY" \ --connect-timeout 10 --max-time 30 2>/dev/null) || { log_error "Cannot connect to config server, please check network" return 1 } elif command -v wget &> /dev/null; then response=$(wget -qO- --timeout=30 \ --header='User_login_country: US' \ --header='Content-Type: text/plain' \ --post-data="$CONFIG_BODY" \ "$CONFIG_API" 2>/dev/null) || { ``` `scripts/update.sh:150-217`: ```bash do_update() { local remote_url="$1" local remote_version="$2" if [ -z "$remote_url" ]; then log_error "No Skill download URL found" return 1 fi log_info "Downloading Skill update package (v${remote_version})..." log_info "Download URL: ${remote_url}" # Create temp directory local tmp_dir=$(mktemp -d) ...[truncated 4983 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:122

Finding

Installer Executes a Downloaded Binary Without Authenticity Verification

Content

View full analysis

/dev/null; then curl -fSL --progress-bar -o "$tmp_file" "$download_url" elif command -v wget &> /dev/null; then wget -q --show-progress -O "$tmp_file" "$download_url" else log_error "Neither curl nor wget found. Please install one of them." exit 1 fi # Extract archive log_info "Extracting..." if [[ "$filename" == *.tar.gz ]]; then tar -xzf "$tmp_file" -C "$tmp_dir" elif [[ "$filename" == *.zip ]]; then if command -v unzip &> /dev/null; then unzip -q "$tmp_file" -d "$tmp_dir" else log_error "unzip not found. Please install unzip." exit 1 fi fi # Find the terabox binary in extracted files local extracted_bin extracted_bin=$(find "$tmp_dir" -name "terabox" -type f ! -name "*.tar.gz" ! -name "*.zip" | head -1) if [ -z "$extracted_bin" ]; then # On Windows, look for .exe extracted_bin=$(find "$tmp_dir" -name "terabox.exe" -type f | head -1) fi if [ -z "$extracted_bin" ]; then log_error "Could not find terabox binary in the downloaded archive" exit 1 fi # Install binary cp "$extracted_bin" "$TERABOX_BIN" chmod +x "$TERABOX_BIN" ``` `scripts/install.sh:172-184`: ```bash if [ -x "$TERABOX_BIN" ]; then # Check PATH if [[ ":$PATH:" != *":$INSTALL_DIR:"* ]]; then log_warn "Please add ~/.local/bin to your PATH:" echo "" echo " e ...[truncated 2305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: reference/troubleshooting.md:107

Finding

Documentation Exposes Share Passwords and Authentication Tokens Through Unsafe Diagnostics

Content

View full analysis

--pwd [--path ] # Specify save directory terabox share-save "https://terabox.com/s/1xxxxx" --pwd abcd --path my-folder/ # Transfer specific files by ID terabox share-save "https://terabox.com/s/1xxxxx" --pwd abcd --fsid 12345,12346 ``` `reference/examples.md:271-277`: ```bash #!/bin/bash SHARE_URL="https://terabox.com/s/1xxxxx" PASSWORD="abcd" DEST_DIR="./shared-files" mkdir -p "$DEST_DIR" terabox share-download "$SHARE_URL" "$DEST_DIR" --pwd "$PASSWORD" ``` `reference/troubleshooting.md:107-115`: ```markdown ## Logging and Debugging ### View Configuration ```bash cat ~/.config/terabox/config.json ``` ``` `reference/terabox-commands.md:666-677` shows that this configuration contains bearer credentials: ```json { "version": 1, "auth": { "access_token": "...", "refresh_token": "...", "expires_at": 1234567890 }, "endpoints": { "api_domain": "www.terabox.com", "upload_domain": "c-jp.terabox.com" }, ``` ### Technical Analysis The documented `--pwd` interface places share passwords in the process argument vector. Depending on the operating system and process isolation settings, command-line arguments may be visible through process inspection facilities such as `ps` or `/proc`, and they may also be retained in shell history, execution logs, terminal recordings, or Agent transcripts. The integration example additionally encourages storing a password in a shell variable. Although quoting prevents shell expansion vulnerabilities, the value is still forwarded as an argument and may be retained in sc ...[truncated 1956 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as a cloud-storage management helper, but it also performs self-update, remote package retrieval, local file replacement, and installation into ~/.local/bin. That mismatch hides material behavior from users and policy systems, creating a supply-chain and consent problem because the skill can modify local executables outside the stated storage-management scope.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

#   - `terabox update check` - Check only
#   - `terabox update rollback` - Rollback to previous version
#   - The CLI also auto-checks for updates on every command execution
#     (disable with --no-check-update flag)

set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/examples.md (reported line 231)May include surrounding context.

md

#   - `terabox update check` - Check only
#   - `terabox update rollback` - Rollback to previous version
#   - The CLI also auto-checks for updates on every command execution
#     (disable with --no-check-update flag)

set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/terabox-commands.md (reported line 520)May include surrounding context.

md

#   - `terabox update check` - Check only
#   - `terabox update rollback` - Rollback to previous version
#   - The CLI also auto-checks for updates on every command execution
#     (disable with --no-check-update flag)

set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference/terabox-commands.md (reported line 577)May include surrounding context.

md

#   - `terabox update check` - Check only
#   - `terabox update rollback` - Rollback to previous version
#   - The CLI also auto-checks for updates on every command execution
#     (disable with --no-check-update flag)

set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/update.sh (reported line 11)May include surrounding context.

sh

#   - `terabox update check` - Check only
#   - `terabox update rollback` - Rollback to previous version
#   - The CLI also auto-checks for updates on every command execution
#     (disable with --no-check-update flag)

set -e

Self-Modification

High

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This script performs self-modification by downloading and extracting an update over the existing skill files. In a cloud-storage helper skill, self-update substantially increases risk because remote content can change local code and behavior; if the update channel is compromised, future executions may run attacker-supplied logic.

Content

Scanner excerpt · scripts/update.sh (reported line 323)May include surrounding context.

sh

# User confirmation
    if [ "$auto_yes" != "yes" ]; then
        echo -n -e "${YELLOW}Update Skill to v${remote_version}? [y/N] ${NC}"
        read -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands for installation, login, and automatic updates, but it does not declare any explicit tool scope or allowed-tools boundary. This makes the effective execution capability broader and less auditable, increasing the chance that an agent may run powerful shell actions without clear consent or policy enforcement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that all operations are restricted to the application sandbox, yet the install flow writes to ~/.local/bin in the user's home directory. This is a trust-boundary violation: users may believe the skill is sandbox-confined when it actually persists binaries outside that boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installation flow directs execution of a shell script that downloads a binary from a CDN and installs it into the user's home directory without clearly warning about the trust and persistence implications. This is dangerous because it normalizes remote code acquisition and local binary installation without informed consent or integrity-verification guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill specifies that every operation should silently run an update script before the requested command, while continuing even on failure. This introduces hidden code execution before normal use, turning routine storage actions into a recurring supply-chain opportunity without explicit user awareness or approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example explicitly demonstrates creating a public share with no password, which can expose file contents to anyone with the link and normalizes insecure sharing without any warning. In a cloud-storage skill, this is contextually relevant and plausible user behavior, so omitting a caution increases the risk of accidental data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented default behavior for share-download is to download all non-directory files when --fsid is omitted, but the documentation does not elevate this as a safety warning. In an agent workflow, an imprecise or attacker-influenced share URL could trigger bulk local data ingestion, causing disk exhaustion, malware exposure, or retrieval of more data than intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill for managing TeraBox storage operations such as login, upload, download, share, and transfer. This file also documents update, update apply, and update rollback, which modify the local CLI installation and version state rather than perform storage operations, making them unjustified by the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Automatic update checks on every command execution introduce unsolicited outbound network activity outside the user’s immediate storage action, which can leak usage metadata and create an unexpected trust dependency on an update service. In an agent setting, this expands the tool's network behavior and may enable silent remote influence over when or how the binary changes unless tightly controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The troubleshooting guide instructs users to print ~/.config/terabox/config.json directly, which may expose OAuth tokens, API credentials, account identifiers, or other sensitive session data in terminal history, logs, screenshots, or shared support transcripts. In a support/debugging context, users are especially likely to paste command output into tickets or chats, making credential disclosure more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The installer downloads an executable archive from a remote CDN and installs the contained binary into the user's PATH without any integrity verification such as a hardcoded checksum or signature validation. If the CDN, DNS, TLS trust chain, or release pipeline is compromised, a malicious binary could be delivered and executed as a trusted local tool, leading to full compromise of user data and cloud credentials. The skill context makes this more dangerous because the installed CLI handles TeraBox login and tokens, so a trojanized binary could steal credentials, access cloud files, or exfiltrate sensitive data.

Content

Scanner excerpt · scripts/install.sh (reported line 129)May include surrounding context.

sh

local tmp_file="${tmp_dir}/${filename}"

    log_info "Downloading terabox CLI v${VERSION}..."
    if command -v curl &> /dev/null; then
        curl -fSL --progress-bar -o "$tmp_file" "$download_url"
    elif command -v wget &> /dev/null; then
        wget -q --show-progress -O "$tmp_file" "$download_url"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This updater sends outbound requests to a remote configuration service and later uses the response to determine what package to download and install. In the context of a self-updating script, external transmission is security-relevant because a compromised endpoint, redirected URL, or attacker-controlled override can steer the updater to malicious content.

Content

Scanner excerpt · scripts/update.sh (reported line 100)May include surrounding context.

sh

fetch_skills_info() {
    local response=""

    if command -v curl &> /dev/null; then
        response=$(curl -s --location -X GET "$CONFIG_API" \
            -H 'User_login_country: US' \
            -H 'Content-Type: text/plain' \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends a hard-coded User_login_country: US header in both curl and wget requests. This enforces a specific locale/country context for all users, and the file does not offer a choice or explain why US routing is required.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The wget path performs the same remote config fetch and therefore carries the same trust and supply-chain risk as the curl path. Because the response controls update metadata, any compromise of the remote source can influence which archive is installed into the skill directory and potentially into the user's executable path.

Content

Scanner excerpt · scripts/update.sh (reported line 109)May include surrounding context.

sh

log_error "Cannot connect to config server, please check network"
            return 1
        }
    elif command -v wget &> /dev/null; then
        response=$(wget -qO- --timeout=30 \
            --header='User_login_country: US' \
            --header='Content-Type: text/plain' \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script claims to manage skill-level updates, but it also replaces the local terabox executable in ~/.local/bin. That expands the trust boundary from updating this skill's own files to deploying executable code on the user's system, creating a software supply-chain risk if the update source or archive is compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/update.sh (reported line 248)May include surrounding context.

sh

echo ""
                echo "Options:"
                echo "  --check, -c   Check for updates only, do not install"
                echo "  --yes, -y     Skip confirmation, auto-update"
                echo "  --help        Show help"
                exit 0
                ;;

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description in L003 emphasizes storage operations such as login, upload, download, share, and transfer. The documented command set additionally exposes move/copy/rename/search/info operations (L152-L166), user-info/quota access (L168-L173), and CLI update/rollback/version management (L175-L185), which are broader than the narrowly described set. This is a semantic scope expansion in the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Automatic update checks create network activity on every command and may transmit system or usage metadata, but the document presents this behavior as a feature without a privacy or network-disclosure warning. Users should be informed that routine commands trigger outbound update-check behavior unless disabled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L189-L197 says the skill must use the login script and specifically requires @skills/terabox-storage/scripts/login.sh (L196). But the example immediately above uses bash scripts/login.sh (L191-L193), which is a contradictory instruction about what should actually be executed. This can cause the agent to use a different script path than the one the documentation mandates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.