Security audit

NetDisk Search

Security checks for vulnerabilities and agentic risk

Overview

This is a real net-disk search helper, but it needs review because it can deploy a Docker service and send searches, share links, and extraction passwords to an API with weak disclosure and control boundaries.

Install only if you intend to run this net-disk search service and understand the Docker/API exposure. Prefer a trusted local endpoint, bind or firewall the service, enable authentication with a throwaway password, avoid remote HTTP APIs for private links or extraction codes, and review deploy.sh before allowing an agent to run deployment commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented trigger phrases are broad, everyday-language commands such as searching for movies or resources, which increases the chance the skill will activate unintentionally in normal conversation. In an agent setting, unintended invocation can cause unreviewed queries to be sent to the configured API and may surface or fetch potentially sensitive or policy-problematic content.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README describes sending user search queries and URLs directly to a local or remote API but does not warn that these inputs leave the agent context and may be logged, cached, or processed by another service. In a skill environment, users may assume searches are local, so the lack of disclosure creates privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly supports link-checking requests with passwords or extraction codes, but it does not warn that these credentials are transmitted to the API service. Because these codes can grant access to shared files, sending them without clear disclosure can leak sensitive access material to logs, operators, or compromised backends.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases are broad everyday terms such as 搜资源/找资源/搜电影/找电影, which can easily match normal conversation and cause unintended activation. Because this skill can lead to network searches and deployment-related actions, accidental triggering expands the risk beyond a simple UX issue into unintended external actions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The documentation says the agent can be triggered by broad natural-language requests like helping search or deploy, without clear boundaries on when the skill should or should not activate. In context, this is more dangerous because the same skill also documents shell-based deployment and link checking, so a casual phrase could initiate nontrivial external behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The deployment instructions start a Docker container and expose a local API endpoint on a host port, but the documentation does not clearly warn users about these side effects or the security implications. This omission is risky because users may unknowingly expose a service, pull an unpinned image, and create a reachable API surface on their machine.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The API reference explicitly documents sending user-provided share links and optional extraction passwords to the service for link validation, but it does not warn that these values may be sensitive credentials or copyrighted-resource locators. In this skill’s context, the service aggregates and checks third-party cloud-share links, so users may submit private or semi-private links and passwords without understanding the privacy, logging, or retention implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script transmits user-supplied links, and potentially extraction passwords, to a configurable HTTP API endpoint without an explicit consent prompt, warning, or clear trust boundary. In this skill’s context, the tool is specifically intended to process possibly private cloud-storage URLs, so silent forwarding to localhost, an environment-controlled URL, or a user-specified endpoint can expose sensitive resources or access credentials to an unintended service.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script echoes the supplied authentication password back to the terminal in cleartext and also embeds it in a sample curl command. This can expose credentials through terminal scrollback, screen sharing, shell session recording, CI logs, or operator screenshots, especially in a deployment script where secrets are likely to be real production credentials.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends user search terms and filters to an API endpoint that may be remote, including a built-in non-local default candidate, without clearly warning the user that their queries leave the machine. Because these queries can reveal interests, sensitive topics, or copyrighted content searches, this creates a privacy and data-exposure risk, especially when the API is third-party or uses plain HTTP.

External Transmission

Medium

Category: Data Exfiltration
Content: **示例:** ```bash curl -X POST http://localhost:8888/api/check/links \ -H "Content-Type: application/json" \ -d '{ "items": [
Confidence: 81% confidence
Finding: This example documents transmitting share links and optional extraction passwords in a POST body to the service, which is an intentional feature but still a real data-handling risk because these values can be sensitive secrets. In the context of a netdisk search/link-check tool, operators may log requests or forward checks to upstream services, increasing the chance of credential leakage or unauthorized reuse of submitted links.

Static analysis

No suspicious patterns detected.