Baidudisk Mcp

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:42 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Baidu Netdisk MCP integration, but its registration path delegates to an unaudited outside script and its URL-upload feature has a credible internal-network request risk.

Review this before installing. Only use it with a Baidu token you are comfortable granting file-management access, avoid running the packaged registration wrapper until the missing/out-of-package installer script is resolved, and treat URL upload as risky unless the SSRF validation is fixed or restricted to trusted domains.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/register_mcporter.sh:4
• Finding: Registration Wrapper Executes an Unverified Script Outside the Audited Project<![CDATA[ ## Vulnerability Details **File Location**: `scripts/register_mcporter.sh:4-7` **Vulnerability Type**: Execution of an external, integrity-unverified workspace script **Risk Level**: High ### Complete Code Snippet ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" WORKSPACE="$(cd "$SCRIPT_DIR/../../.." && pwd)" exec "$WORKSPACE/scripts/baidudisk_mcporter.sh" register "$@" ``` ### Technical Analysis The supplied registration wrapper does not implement registration within the audited project. It derives a workspace path three levels above its own directory and transfers execution to `scripts/baidudisk_mcporter.sh` at that external location. Because the target script is outside the audited artifact, its content, ownership, and integrity are not controlled by this Skill. The use of `exec` replaces the current process with that script and passes through all additional user arguments. The documentation also references `scripts/baidudisk_mcporter.sh`, but that file is not present in the supplied project. This creates an ambiguous trust boundary in which a legitimate-looking registration action depends on unaudited local code. ### Attack Path 1. An attacker gains the ability to create or replace the workspace-level `scripts/baidudisk_mcporter.sh`. 2. The user or agent invokes `scripts/register_mcporter.sh` to register the MCP server. 3. The wrapper resolves the external workspace path without validating the target's ownership or integrity. 4. `exec` launches the attacker-controlled script under the invoking user's privileges. 5. The external script can alter MCP configuration, execute arbitrary commands, access files available to the user, or install additional malicious tooling. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running registration. The scope includes any files, credentials, configuration, and processes accessible to that user. The external script coul ...[truncated 119 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the complete registration implementation inside this project rather than delegating to an external workspace script. 2. Resolve the executable relative to `SCRIPT_DIR`, for example: ```bash TARGET="$SCRIPT_DIR/baidudisk_mcporter.sh" ``` 3. Fail closed if the expected script is missing, is a symbolic link, has unexpected ownership, or is writable by untrusted users. 4. If delegation is unavoidable, verify the target against a trusted cryptographic digest before execution. 5. Avoid searching for or implicitly trusting same-named scripts elsewhere in the workspace. 6. Correct `SKILL.md` so that its registration command references the actual packaged and audited script. 7. Ensure generated MCP configuration points directly to reviewed executables and fixed project paths. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: server/netdisk.py:1084
• Finding: DNS-Rebinding Race Bypasses URL Upload SSRF Validation<![CDATA[ ## Vulnerability Details **File Location**: `server/netdisk.py:1084-1114` and `server/netdisk.py:1142-1151` **Vulnerability Type**: Server-Side Request Forgery through DNS validation/use mismatch **Risk Level**: High ### Complete Code Snippet ```python def _validate_public_http_url(url: str) -> urllib.parse.ParseResult: parsed = urllib.parse.urlparse(url) if parsed.scheme not in ("http", "https"): raise ValueError("仅支持 http(s) URL") if not parsed.hostname: raise ValueError("URL 缺少 hostname") host = parsed.hostname.strip().lower() if host == "localhost" or host.endswith(".localhost"): raise ValueError("禁止访问 localhost 地址") resolved_ips: List[ipaddress._BaseAddress] = [] try: resolved_ips.append(ipaddress.ip_address(host)) except ValueError: try: infos = socket.getaddrinfo(host, parsed.port or 80, type=socket.SOCK_STREAM) except socket.gaierror as exc: raise ValueError(f"域名解析失败: {host}, {exc}") from exc seen = set() for info in infos: ip_str = info[4][0] if ip_str in seen: continue seen.add(ip_str) resolved_ips.append(ipaddress.ip_address(ip_str)) for ip in resolved_ips: if _is_forbidden_ip(ip): raise ValueError(f"禁止访问内网或保留地址: {host} -> {ip}") return parsed ``` The validated address is not used for the subsequent connection: ```python opener = urllib.request.build_opener(_NoRedirect) current_url = url tmp_path = "" try: for _ in range(UPLOAD_BY_URL_MAX_REDIRECTS + 1): _validate_public_http_url(current_url) req = urllib.request.Request( current_url, headers={"User-Agent": "openclaw-baidudisk-mcp/2.0"}, method="GET", ) try: with opener.open(req, timeout=timeout_s) as resp: ``` ### Technical Analysis The URL validator resolves the hostname with `socket ...[truncated 1931 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the outbound connection to an IP address that has already passed validation rather than resolving the hostname again. 2. For HTTPS, preserve certificate and hostname verification against the original hostname while connecting to the validated IP. 3. Preserve the original HTTP `Host` header when connecting to a pinned address. 4. After connection establishment, inspect and validate the actual peer address before reading the response. 5. Reapply validation and address pinning independently to every redirect target. 6. Resolve all address families and reject the request if any candidate address is prohibited, unless connection selection is explicitly pinned to an approved address. 7. Apply network-layer egress controls that deny private, loopback, link-local, reserved, and metadata address ranges. Application-layer checks should not be the only defense. 8. Consider an allowlist of trusted source domains if arbitrary URL ingestion is not required. 9. Add automated DNS-rebinding and redirect-to-private-address security tests. ]]>

T08 · Insecure Dependencies

Warning

• Location: server/pyproject.toml:6
• Finding: Runtime Dependencies Are Open-Ended and Not Integrity-Locked<![CDATA[ ## Vulnerability Details **File Location**: `server/pyproject.toml:6-10` **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium ### Complete Code Snippet ```toml dependencies = [ "mcp[cli]>=1.6.0", "python-dateutil>=2.9.0.post0", "urllib3>=1.25.3", "requests>=2.31.0", ] ``` ### Technical Analysis Every dependency is specified using only a lower version bound. No upper bound, exact version, package hash, or lock file is present in the supplied project. Consequently, the documented `uv run` workflow may install versions released after this audit. Those versions have not been reviewed for compatibility or security. Dependencies execute in the same Python environment as the MCP server, which reads the Baidu credential file and handles local file uploads. This finding does not establish that any currently named dependency is malicious. The risk is that future resolution is not reproducible or integrity-bound to the reviewed dependency set. ### Attack Path 1. A future dependency release is compromised, malicious, or introduces a security regression. 2. The user launches or installs the server through `uv` without a reviewed lock file. 3. The resolver selects the new version because it satisfies the open-ended lower bound. 4. Package installation or import executes the newly resolved code. 5. The dependency runs inside the credential-bearing MCP process and can access resources available to that process. ### Impact Assessment A compromised dependency could obtain code execution with the MCP server user's privileges. Because the process reads `~/.openclaw/credentials/baidudisk.json` and accepts paths for local-file upload, the potential scope includes the Baidu access token, accessible local files, MCP inputs, network access, and cloud file operations. The likelihood depends on an upstream compromise or unsafe update, but the lack of reproducible dependency resolution increases the supply-chain ...[truncated 15 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate and commit a reviewed `uv.lock` file. 2. Pin direct dependencies to exact reviewed versions. 3. Use package hash verification where the installation workflow supports it. 4. Resolve and review transitive dependencies as part of the release process. 5. Perform dependency updates through controlled pull requests with security scanning and regression testing. 6. Configure automated vulnerability monitoring for both direct and transitive packages. 7. Remove unused dependencies, such as `requests`, if runtime analysis confirms they are unnecessary. 8. Build deployments from a locked dependency set rather than resolving the latest compatible versions at server startup. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Most of the description matches the code well: it is indeed a stdio MCP server for Baidu Netdisk, uses hot-reload-friendly credential loading on every tool call, falls back to a default credential file and environment variables, and exposes a broad official/legacy tool surface. The mismatch is that the description presents the toolset as available Netdisk operations, including official 2.0 tools and legacy aliases, but several named capabilities are not actually implemented. Specifically, file_semantics_search and file_sharelink_set return unsupported placeholders, and download returns a TODO response rather than performing downloads. This is a material description-versus-behavior gap for those capabilities, even though the primary purpose is otherwise accurately represented.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description describes a concrete integration for Baidu Netdisk with MCP/stdIO server behavior and token-file credential management. The actual code shown is only a placeholder __init__.py with comments about import behavior and memory usage. It does not implement or expose the described functionality. Based on this chunk alone, the code's behavior does not match the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a functional integration for Baidu Netdisk operations with specific authentication and server behavior. The supplied code chunk does not implement any of that. It is only a placeholder/comment-only __init__.py file discussing import structure for model classes. This is a materially different purpose and lacks the described capabilities, so the description does not accurately represent the provided code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a full skill for interacting with Baidu Netdisk via an MCP server using token-file-based credentials. The supplied code chunk does not implement server behavior, file-based credential loading, hot reloading, or any Netdisk operations. Instead, it is a generated Python data model for an OAuth token response schema. While OAuth tokens are related to authentication and may be a supporting component of a Netdisk integration, this specific chunk's actual purpose is much narrower and materially different from the declared end-user functionality. Therefore, this is a description/behavior mismatch for the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full skill for interacting with Baidu Netdisk via an MCP server and managing token-file credentials. The supplied code chunk is only an auto-generated OpenAPI model representing a quota response object. It stores typed fields and supports object construction/deserialization, but does not implement the described operational behavior. This is a material mismatch in primary purpose and capabilities, not merely an internal supporting detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This code chunk is infrastructure for OpenAPI client models, not a Baidu Netdisk skill implementation. It defines base model classes, schema composition/discriminator logic, validation helpers, primitive/model deserialization, and file deserialization to a temp file. While such utilities could support an API client somewhere else in the project, this chunk itself does not perform or expose the declared skill purpose. The only resource access shown is local temp-file creation for deserialized file responses, which is incidental and unrelated to the stated hot-reload token credential mechanism. Therefore the description does not accurately represent what this supplied code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description presents a full Baidu Netdisk MCP server with stdio transport and hot-reload token-file credential support for operational use. The supplied code chunk instead is a minimal test/self-check script. It writes a temporary token file, overrides urlopen with a fake responder, calls a few netdisk helper functions, asserts expected outputs, and prints PASS/results. While it is related to Baidu Netdisk and token-file usage, its primary purpose is verification of readonly helper behavior, not serving MCP requests or providing the described toolset. That is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description says the skill provides Baidu Netdisk access via a stdio MCP server using hot-reload token file credentials. The supplied code instead is a standalone self-check script focused on testing the netdisk library's behavior: simulated rate-limit retries, pagination parameter echoing, has_more handling, and rejection of '..' path traversal. Although it does use a temporary token file and references Baidu Netdisk-related functions, those are used only in a mocked test context. The primary purpose and behavior of this chunk are therefore materially different from the declared operational server capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill is for operating Baidu Netdisk via an MCP stdio server using token-file credentials. The supplied code chunk does not implement such a server or actual Netdisk functionality. Instead, it is a standalone validation script that monkeypatches the netdisk client with fake classes, writes a temporary dummy access token, runs search/doclist wrapper calls, verifies argument propagation and default has_more behavior, and prints a self-check result. While it is related to Netdisk and token-file configuration in a supporting/testing sense, its primary purpose is materially different from the declared runtime skill behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares operational steps that read a local credential file, invoke external commands, and perform networked Baidu Netdisk actions, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries increases the chance of over-broad execution, unintended file access, and network use beyond what a reviewer expects.

Session Persistence

Medium

• Category: Rogue Agent

Content

except CredentialError as exc:
        return _error(str(exc))
    except Exception as exc:
        return _error(f"mkdir 执行失败: {exc}")


@mcp.tool()

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

except CredentialError as exc:
        return _error(str(exc))
    except Exception as exc:
        return _error(f"mkdir 执行失败: {exc}")


@mcp.tool()

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This code file defines tools that can move and rename files or directories in a user's Netdisk, which can materially affect user data organization and accessibility. While delete has an explicit confirm gate, these other mutating operations rely only on their functional purpose and short docstrings, without a visible confirmation prompt or stronger user-facing warning in the code/help text about unintended data changes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The batch tools perform large-scale file operations, potentially affecting many user files in a single invocation. Although dry_run and some path-prefix controls exist, there is no explicit warning in the code/help text that these tools may cause broad, hard-to-reverse changes when run with real inputs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This tool downloads data from a user-supplied URL, transmitting network metadata to third parties and storing the content in a local temporary file before uploading it to Netdisk. The code mentions SSRF protection, but it does not clearly disclose to users that invoking the tool causes outbound network access and transient local storage.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This code defines an endpoint that sends `client_secret` as a query parameter to a remote server, which is a safety-relevant network transmission of credentials. The file contains no confirmation prompt, logging/print disclosure, or explanatory warning in the docstrings that sensitive authentication data will be sent off-host.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The device-token endpoint includes `client_secret` in the request query parameters, which is a sensitive network operation. Although the method is part of an auth client, the code and method docstring do not warn the caller that secrets will be transmitted to an external service.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This endpoint sends both `refresh_token` and `client_secret` as query parameters to an external server, which is a sensitive authentication operation. The file lacks any user-facing disclosure or warning that invoking this method will transmit long-lived credentials/tokens off the local system.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code defines methods that send the required `access_token` as a query parameter to a remote HTTPS endpoint, which is a network operation involving sensitive credential material. Although the docstring lists parameters, it does not warn users that their token will be transmitted to an external service, and there is no confirmation prompt or user-facing logging in this file.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This method sends the required `access_token` to a remote server as part of an HTTP GET request, which is a sensitive network action. The file includes no user-oriented warning that credentials are being sent externally, beyond the bare parameter listing in the generated docstring.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This method performs a remote API call and includes `access_token` in the query parameters, which is transmission of sensitive credential data. The code contains no confirmation, print/log notice, or explanatory warning that user credentials will be sent to an external service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This method sends the required `access_token` and user-provided search `key` to a remote endpoint, which can expose credential material and user data over the network. The generated docstring describes arguments but does not disclose the privacy impact or external transmission to users.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The client sends `access_token` as a query parameter in outbound HTTP requests to `https://pan.baidu.com`, which involves transmitting credential material over the network. Although this is functionally required, the method documentation does not warn that credentials are being sent to a remote service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `filemanagerdelete` method performs a remote delete action against the file manager API, which is a destructive operation. In this file there is no confirmation prompt, warning message, logging, or explicit docstring warning that user files may be deleted when this method is invoked.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Within `filemanagerdelete`, the provided `access_token` is included in the request sent to the remote file-management API while also issuing a delete action. The combination of credential transmission and destructive behavior lacks any explicit cautionary language in the method documentation.

Static analysis

No suspicious patterns detected.