Security audit

Baidudisk Mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Baidu Netdisk MCP integration, but its registration path delegates to an unaudited outside script and its URL-upload feature has a credible internal-network request risk.

Review this before installing. Only use it with a Baidu token you are comfortable granting file-management access, avoid running the packaged registration wrapper until the missing/out-of-package installer script is resolved, and treat URL upload as risky unless the SSRF validation is fixed or restricted to trusted domains.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/register_mcporter.sh:4
Finding: Registration Wrapper Executes an Unverified Script Outside the Audited Project
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: server/netdisk.py:1084
Finding: DNS-Rebinding Race Bypasses URL Upload SSRF Validation
Content: View full analysis
urllib.parse.ParseResult: parsed = urllib.parse.urlparse(url) if parsed.scheme not in ("http", "https"): raise ValueError("仅支持 http(s) URL") if not parsed.hostname: raise ValueError("URL 缺少 hostname") host = parsed.hostname.strip().lower() if host == "localhost" or host.endswith(".localhost"): raise ValueError("禁止访问 localhost 地址") resolved_ips: List[ipaddress._BaseAddress] = [] try: resolved_ips.append(ipaddress.ip_address(host)) except ValueError: try: infos = socket.getaddrinfo(host, parsed.port or 80, type=socket.SOCK_STREAM) except socket.gaierror as exc: raise ValueError(f"域名解析失败: {host}, {exc}") from exc seen = set() for info in infos: ip_str = info[4][0] if ip_str in seen: continue seen.add(ip_str) resolved_ips.append(ipaddress.ip_address(ip_str)) for ip in resolved_ips: if _is_forbidden_ip(ip): raise ValueError(f"禁止访问内网或保留地址: {host} -> {ip}") return parsed ``` The validated address is not used for the subsequent connection: ```python opener = urllib.request.build_opener(_NoRedirect) current_url = url tmp_path = "" try: for _ in range(UPLOAD_BY_URL_MAX_REDIRECTS + 1): _validate_public_http_url(current_url) req = urllib.request.Request( current_url, headers={"User-Agent": "openclaw-baidudisk-mcp/2.0"}, method="GET", ) try: with opener.open(req, timeout=timeout_s) as resp: ``` ### Technical Analysis The URL validator resolves the hostname with `socket ...[truncated 1931 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: server/pyproject.toml:6
Finding: Runtime Dependencies Are Open-Ended and Not Integrity-Locked
Content: View full analysis
=1.6.0", "python-dateutil>=2.9.0.post0", "urllib3>=1.25.3", "requests>=2.31.0", ] ``` ### Technical Analysis Every dependency is specified using only a lower version bound. No upper bound, exact version, package hash, or lock file is present in the supplied project. Consequently, the documented `uv run` workflow may install versions released after this audit. Those versions have not been reviewed for compatibility or security. Dependencies execute in the same Python environment as the MCP server, which reads the Baidu credential file and handles local file uploads. This finding does not establish that any currently named dependency is malicious. The risk is that future resolution is not reproducible or integrity-bound to the reviewed dependency set. ### Attack Path 1. A future dependency release is compromised, malicious, or introduces a security regression. 2. The user launches or installs the server through `uv` without a reviewed lock file. 3. The resolver selects the new version because it satisfies the open-ended lower bound. 4. Package installation or import executes the newly resolved code. 5. The dependency runs inside the credential-bearing MCP process and can access resources available to that process. ### Impact Assessment A compromised dependency could obtain code execution with the MCP server user's privileges. Because the process reads `~/.openclaw/credentials/baidudisk.json` and accepts paths for local-file upload, the potential scope includes the Baidu access token, accessible local files, MCP inputs, network access, and cloud file operations. The likelihood depends on an upstream compromise or unsafe update, but the lack of reproducible dependency resolution increases the supply-chain ...[truncated 15 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Most of the description matches the code well: it is indeed a stdio MCP server for Baidu Netdisk, uses hot-reload-friendly credential loading on every tool call, falls back to a default credential file and environment variables, and exposes a broad official/legacy tool surface. The mismatch is that the description presents the toolset as available Netdisk operations, including official 2.0 tools and legacy aliases, but several named capabilities are not actually implemented. Specifically, file_semantics_search and file_sharelink_set return unsupported placeholders, and download returns a TODO response rather than performing downloads. This is a material description-versus-behavior gap for those capabilities, even though the primary purpose is otherwise accurately represented.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description describes a concrete integration for Baidu Netdisk with MCP/stdIO server behavior and token-file credential management. The actual code shown is only a placeholder init.py with comments about import behavior and memory usage. It does not implement or expose the described functionality. Based on this chunk alone, the code's behavior does not match the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes a functional integration for Baidu Netdisk operations with specific authentication and server behavior. The supplied code chunk does not implement any of that. It is only a placeholder/comment-only init.py file discussing import structure for model classes. This is a materially different purpose and lacks the described capabilities, so the description does not accurately represent the provided code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full skill for interacting with Baidu Netdisk via an MCP server using token-file-based credentials. The supplied code chunk does not implement server behavior, file-based credential loading, hot reloading, or any Netdisk operations. Instead, it is a generated Python data model for an OAuth token response schema. While OAuth tokens are related to authentication and may be a supporting component of a Netdisk integration, this specific chunk's actual purpose is much narrower and materially different from the declared end-user functionality. Therefore, this is a description/behavior mismatch for the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full skill for interacting with Baidu Netdisk via an MCP server and managing token-file credentials. The supplied code chunk is only an auto-generated OpenAPI model representing a quota response object. It stores typed fields and supports object construction/deserialization, but does not implement the described operational behavior. This is a material mismatch in primary purpose and capabilities, not merely an internal supporting detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk is infrastructure for OpenAPI client models, not a Baidu Netdisk skill implementation. It defines base model classes, schema composition/discriminator logic, validation helpers, primitive/model deserialization, and file deserialization to a temp file. While such utilities could support an API client somewhere else in the project, this chunk itself does not perform or expose the declared skill purpose. The only resource access shown is local temp-file creation for deserialized file responses, which is incidental and unrelated to the stated hot-reload token credential mechanism. Therefore the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents a full Baidu Netdisk MCP server with stdio transport and hot-reload token-file credential support for operational use. The supplied code chunk instead is a minimal test/self-check script. It writes a temporary token file, overrides urlopen with a fake responder, calls a few netdisk helper functions, asserts expected outputs, and prints PASS/results. While it is related to Baidu Netdisk and token-file usage, its primary purpose is verification of readonly helper behavior, not serving MCP requests or providing the described toolset. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says the skill provides Baidu Netdisk access via a stdio MCP server using hot-reload token file credentials. The supplied code instead is a standalone self-check script focused on testing the netdisk library's behavior: simulated rate-limit retries, pagination parameter echoing, has_more handling, and rejection of '..' path traversal. Although it does use a temporary token file and references Baidu Netdisk-related functions, those are used only in a mocked test context. The primary purpose and behavior of this chunk are therefore materially different from the declared operational server capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says the skill is for operating Baidu Netdisk via an MCP stdio server using token-file credentials. The supplied code chunk does not implement such a server or actual Netdisk functionality. Instead, it is a standalone validation script that monkeypatches the netdisk client with fake classes, writes a temporary dummy access token, runs search/doclist wrapper calls, verifies argument propagation and default has_more behavior, and prints a self-check result. While it is related to Netdisk and token-file configuration in a supporting/testing sense, its primary purpose is materially different from the declared runtime skill behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares operational steps that read a local credential file, invoke external commands, and perform networked Baidu Netdisk actions, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries increases the chance of over-broad execution, unintended file access, and network use beyond what a reviewer expects.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · server/netdisk.py (reported line 1930)May include surrounding context.
python
except CredentialError as exc: return _error(str(exc)) except Exception as exc: return _error(f"mkdir 执行失败: {exc}") @mcp.tool()

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · server/netdisk.py (reported line 1930)May include surrounding context.
python
except CredentialError as exc: return _error(str(exc)) except Exception as exc: return _error(f"mkdir 执行失败: {exc}") @mcp.tool()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This code file defines tools that can move and rename files or directories in a user's Netdisk, which can materially affect user data organization and accessibility. While delete has an explicit confirm gate, these other mutating operations rely only on their functional purpose and short docstrings, without a visible confirmation prompt or stronger user-facing warning in the code/help text about unintended data changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The batch tools perform large-scale file operations, potentially affecting many user files in a single invocation. Although dry_run and some path-prefix controls exist, there is no explicit warning in the code/help text that these tools may cause broad, hard-to-reverse changes when run with real inputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This tool downloads data from a user-supplied URL, transmitting network metadata to third parties and storing the content in a local temporary file before uploading it to Netdisk. The code mentions SSRF protection, but it does not clearly disclose to users that invoking the tool causes outbound network access and transient local storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code defines an endpoint that sends client_secret as a query parameter to a remote server, which is a safety-relevant network transmission of credentials. The file contains no confirmation prompt, logging/print disclosure, or explanatory warning in the docstrings that sensitive authentication data will be sent off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The device-token endpoint includes client_secret in the request query parameters, which is a sensitive network operation. Although the method is part of an auth client, the code and method docstring do not warn the caller that secrets will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This endpoint sends both refresh_token and client_secret as query parameters to an external server, which is a sensitive authentication operation. The file lacks any user-facing disclosure or warning that invoking this method will transmit long-lived credentials/tokens off the local system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code defines methods that send the required access_token as a query parameter to a remote HTTPS endpoint, which is a network operation involving sensitive credential material. Although the docstring lists parameters, it does not warn users that their token will be transmitted to an external service, and there is no confirmation prompt or user-facing logging in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This method sends the required access_token to a remote server as part of an HTTP GET request, which is a sensitive network action. The file includes no user-oriented warning that credentials are being sent externally, beyond the bare parameter listing in the generated docstring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This method performs a remote API call and includes access_token in the query parameters, which is transmission of sensitive credential data. The code contains no confirmation, print/log notice, or explanatory warning that user credentials will be sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This method sends the required access_token and user-provided search key to a remote endpoint, which can expose credential material and user data over the network. The generated docstring describes arguments but does not disclose the privacy impact or external transmission to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The client sends access_token as a query parameter in outbound HTTP requests to https://pan.baidu.com, which involves transmitting credential material over the network. Although this is functionally required, the method documentation does not warn that credentials are being sent to a remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The filemanagerdelete method performs a remote delete action against the file manager API, which is a destructive operation. In this file there is no confirmation prompt, warning message, logging, or explicit docstring warning that user files may be deleted when this method is invoked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Within filemanagerdelete, the provided access_token is included in the request sent to the remote file-management API while also issuing a delete action. The combination of credential transmission and destructive behavior lacks any explicit cautionary language in the method documentation.
Content: No source excerpt is available for this finding.