ClawHub
Back to skill

Security audit

Pikpak

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward PikPak cloud-drive CLI guide, but users should be careful because it can delete cloud files and uses account credentials.

Install only if you trust the pikpakcli project and are comfortable giving it your PikPak credentials. Before any delete operation, instruct the agent to list the exact target paths first and ask for your confirmation, since the skill itself does not document a recovery or dry-run workflow.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents file deletion commands that can remove cloud-stored data but does not instruct the agent to obtain explicit user confirmation, preview targets, or warn about irreversibility. In an agent context, this increases the chance of accidental or unauthorized destructive actions, especially because the skill is designed to manage a real cloud drive.

Static analysis

No suspicious patterns detected.