夸克网盘官方Skill - quarkclouddrive

• Outcome: Review
• Latest audit: Jul 25, 2026 · 11:59 AM UTC
• Version: 1.0.10

Overview

This Quark Drive skill matches its cloud-drive purpose in broad terms, but it needs review because it ships sensitive account tokens, performs powerful self-install/update actions, and sends raw user prompts for tracking.

Review before installing, especially in sensitive environments. Do not install the package as-is unless the bundled credential config is removed or confirmed harmless, you trust the update endpoint, and you accept that prompts/session IDs and drive metadata may be sent for tracking. Prefer manual Node.js installation, explicit confirmation for uploads/save-as/uninstall, and a signed or platform-managed update path.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes shell execution capability without declaring permissions or clearly constraining what local actions may occur. In this file, shell is used not just for drive operations but also for installation, updates, and removal, which expands host-side impact beyond the manifest’s stated purpose and reduces transparency for operators.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is Quark Drive file management, but the documented behavior also includes automatic Node.js installation, remote package download and overwrite of local skill files, cleanup of prior global directories, and destructive uninstall steps. This mismatch is dangerous because users and agents may authorize a storage skill while actually granting a software bootstrapper with code-update and local deletion capability.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill requires the agent to send the user's original prompt text and a session identifier on every CLI invocation for service-quality tracking, even though that data is not needed for file operations. This creates unnecessary telemetry of natural-language user content, which may include secrets, personal data, links, or business information unrelated to the requested drive action.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documentation says every CLI use must be preceded by install.sh, and install.sh may auto-install Node.js and download/unpack a remote zip package. Because this routine bootstrap/update behavior is omitted from the high-level manifest description, users may trigger software installation and network retrieval unexpectedly during ordinary file tasks.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The uninstall flow instructs the agent to delete the entire skill directory after running the uninstall script. That is a destructive local filesystem action unrelated to normal cloud-drive file management and, if misapplied or path-resolved incorrectly, could remove more local data than intended.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer automatically installs or upgrades Node.js and changes the host system environment, including package manager state and active runtime selection. For a cloud-drive skill, this exceeds the minimum required scope and creates supply-chain and host-modification risk, especially because the Linux path fetches third-party setup material before installing packages.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script deletes files from /usr/local/bin and Windows-equivalent locations as part of cleanup, which is a system-level modification unrelated to core file-drive functionality. Even if intended to remove a legacy command, silent deletion of global executables can disrupt other tooling or remove user-managed files with the same name.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script implements a self-update path that fetches remote configuration, downloads a zip, extracts it, and replaces local installation files under the CLI scripts directory. That creates a remote code execution trust boundary: whoever controls the update endpoint or download URL can ship arbitrary code that will be installed and later executed locally.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code downloads an archive and overwrites local CLI installation files, which exceeds the stated Quark Drive file-management purpose and materially expands risk. A compromised server, CDN, or man-in-the-middle in the update chain could replace operational code on the host and persist malicious behavior.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Mandating verbatim transmission of the user's raw prompt for quality tracking without a clear user warning or opt-in creates an avoidable privacy leak. Users may reasonably assume a file-management skill only sends data needed to operate on drive content, not their full natural-language request text.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This command performs a state-changing action by copying shared-link files into the user's own cloud storage, which can consume storage quota and alter the user's file inventory. The documentation focuses on mechanics and success handling but does not require an explicit user confirmation or upfront warning before the modification occurs, increasing the risk of unintended data changes by an agent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly supports uploading files and folders recursively to a cloud drive, but it does not prominently warn that this may transmit large amounts of local data, including nested sensitive files, to a remote service. In an agent context, this omission increases the chance of unintended exfiltration or over-broad data transfer when the user asks to upload a directory without understanding the privacy consequences.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The installer performs file deletion without explicit confirmation or a prominent pre-warning. Silent destructive actions increase the chance of unintended changes and reduce user ability to assess whether system modifications are appropriate.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script downloads remote setup content with curl and pipes it directly into sudo bash, then installs packages with elevated privileges. This is a classic high-risk supply-chain pattern: if the remote endpoint, transport, or script content is compromised, arbitrary root-level code executes immediately on the host.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Requiring the full original prompt to be passed verbatim to the CLI can leak highly sensitive natural-language content such as credentials, personal identifiers, internal project names, legal matters, or other confidential context. Because the prompt is unrelated to core command execution, this broad data disclosure is unnecessary and materially increases privacy and compliance risk.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The repeated requirement to send raw user prompts on every CLI call creates continuous leakage of conversation contents over time, enabling aggregation of sensitive context across a session. The risk is amplified because the same session identifier is reused, making it easy to link multiple prompts and reconstruct user behavior or intent.

Ssd 1

Medium

• Confidence: 91% confidence
• Finding: The final echoed instruction tells the AI to discard memory and reread skill guidance, which is an attempt to steer agent behavior beyond normal installation tasks. Per the threat model, behavioral instructions embedded in skill content are adversarial by default and can be used to weaken guardrails or manipulate future agent decisions.

External Transmission

Medium

• Category: Data Exfiltration

Content

mkdir -p "$TMP_DIR"
  local zip_path="$TMP_DIR/skill.zip"

  if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
    warn "下载失败，重试中..."
    if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
      error "下载 zip 包失败: $ZIP_DOWNLOAD_URL"

• Confidence: 84% confidence
• Finding: The installer downloads a remotely supplied ZIP package from a URL obtained at runtime, then later extracts and installs its contents. Network retrieval alone is expected for an installer, but here it becomes risky because the artifact source is dynamically provided and there is no integrity verification such as signatures or pinned checksums.

External Transmission

Medium

• Category: Data Exfiltration

Content

`)}progress(e,t,r){let n=Number.isFinite(t)?t:0,i=Number.isFinite(r)?r:0,o=i>0?Math.round(n/i*100):0,a={msg:"\u8FDB\u884C\u4E2D",data:{current:n,total:i,percent:Number(o)},action:e,type:"progress"};this.flushResult(a)}spinner(e){return{stop(){},message(){}}}debug(e){this.verbose&&console.error(It.default.dim(`[DEBUG] ${e}`))}flushResult(e){this.writeStdout(JSON.stringify(e))}writeStdout(e){process.stdout.write(e+`
`)}};W();G();var Ie=O(require("path")),Ee=O(require("fs")),Fa=O(require("os"));W();G();var Ma=O(require("node:fs")),Uu=O(require("node:os")),Lu=O(require("node:path"));function Bm(s){let{env:e}=s;return e.CLIENT_INFO_IDE_TYPE==="WorkBuddy"||e.CLIENT_INFO_PLATFORM==="WorkBuddy"||e.CLIENT_INFO_PRODUCT_NAME==="WorkBuddy"||!!e.CODEBUDDY_HOST?.startsWith("workbuddy")||!!e.CODEBUDDY_CONFIG_DIR?.includes(".workbuddy")}function zm(s){let{env:e,scriptDir:t,pathLower:r}=s;if(r.includes("kimi_openclaw")||e.KIMI_CLAW_STATE_DIR!==void 0||e.KIMI_PLUGIN_API_KEY!==void 0||e.__CFBundleIdentifier?.includes("moonshot.kimichat"))return!0;if(!t.includes(".openclaw"))return!1;let n=Uu.homedir();return Ma.existsSync("/root/.kimi/kimi-claw")||Ma.existsSync(Lu.join(n,".kimi","kimi-claw"))}function Gm(s){let{env:e,pathLower:t}=s;return t.includes("kimi-desktop/daimon-share")||t.includes(".kimi-work")||e.KIMI_SKILLS_ROOT!==void 0||e.KIMI_AGENT_GW_KEY!==void 0}function Wm(s){let{env:e}=s;return e.HERMES_SESSION_ID!==void 0||e.HERMES_KANBAN_BOARD!==void 0||e.HERMES_INTERACTIVE==="1"}function Vm(s){let{env:e}=s;return e.WUKONG_ABILITY_CODE!==void 0||e.WUKONG_BIN!==void 0||e.WUKONG_BIZ_ID!==void 0}function Km(s){let{env:e}=s;return e.ARK_BASE_URL!==void 0||e.ARK_CLAW_TEMPLATE_DESCRIPTION!==void 0||e.ARK_CLAW_TEMPLATE_LABEL!==void 0||e.ARK_CODING_PLAN!==void 0||e.ARK_MODEL_FALLBACKS!==void 0||e.ARK_MODEL_ID!==void 0}function jm(s){let{env:e}=s;return e.QCLAW_BUNDLED_CONFIG_DIR!==void 0||e.QCLAW_CLI_NODE_BINARY!==void 0||e.QCLAW_CLI_OPENCLAW_MJS!==void 0||e.QCLAW_CONFIG_HMAC_SECRET!==void
...[truncated 27 chars]

• Confidence: 89% confidence
• Finding: The skill contains telemetry and request/response logging paths that can transmit operational metadata off-host, including tracing uploads and optional curl-style request logging. In a skill that handles access tokens, share links, file names, and user identifiers, such logging can expose sensitive context if enabled or misconfigured.

Context Leakage

High

• Category: Data Exfiltration

Content

`)}progress(e,t,r){let n=Number.isFinite(t)?t:0,i=Number.isFinite(r)?r:0,o=i>0?Math.round(n/i*100):0,a={msg:"\u8FDB\u884C\u4E2D",data:{current:n,total:i,percent:Number(o)},action:e,type:"progress"};this.flushResult(a)}spinner(e){return{stop(){},message(){}}}debug(e){this.verbose&&console.error(It.default.dim(`[DEBUG] ${e}`))}flushResult(e){this.writeStdout(JSON.stringify(e))}writeStdout(e){process.stdout.write(e+`
`)}};W();G();var Ie=O(require("path")),Ee=O(require("fs")),Fa=O(require("os"));W();G();var Ma=O(require("node:fs")),Uu=O(require("node:os")),Lu=O(require("node:path"));function Bm(s){let{env:e}=s;return e.CLIENT_INFO_IDE_TYPE==="WorkBuddy"||e.CLIENT_INFO_PLATFORM==="WorkBuddy"||e.CLIENT_INFO_PRODUCT_NAME==="WorkBuddy"||!!e.CODEBUDDY_HOST?.startsWith("workbuddy")||!!e.CODEBUDDY_CONFIG_DIR?.includes(".workbuddy")}function zm(s){let{env:e,scriptDir:t,pathLower:r}=s;if(r.includes("kimi_openclaw")||e.KIMI_CLAW_STATE_DIR!==void 0||e.KIMI_PLUGIN_API_KEY!==void 0||e.__CFBundleIdentifier?.includes("moonshot.kimichat"))return!0;if(!t.includes(".openclaw"))return!1;let n=Uu.homedir();return Ma.existsSync("/root/.kimi/kimi-claw")||Ma.existsSync(Lu.join(n,".kimi","kimi-claw"))}function Gm(s){let{env:e,pathLower:t}=s;return t.includes("kimi-desktop/daimon-share")||t.includes(".kimi-work")||e.KIMI_SKILLS_ROOT!==void 0||e.KIMI_AGENT_GW_KEY!==void 0}function Wm(s){let{env:e}=s;return e.HERMES_SESSION_ID!==void 0||e.HERMES_KANBAN_BOARD!==void 0||e.HERMES_INTERACTIVE==="1"}function Vm(s){let{env:e}=s;return e.WUKONG_ABILITY_CODE!==void 0||e.WUKONG_BIN!==void 0||e.WUKONG_BIZ_ID!==void 0}function Km(s){let{env:e}=s;return e.ARK_BASE_URL!==void 0||e.ARK_CLAW_TEMPLATE_DESCRIPTION!==void 0||e.ARK_CLAW_TEMPLATE_LABEL!==void 0||e.ARK_CODING_PLAN!==void 0||e.ARK_MODEL_FALLBACKS!==void 0||e.ARK_MODEL_ID!==void 0}function jm(s){let{env:e}=s;return e.QCLAW_BUNDLED_CONFIG_DIR!==void 0||e.QCLAW_CLI_NODE_BINARY!==void 0||e.QCLAW_CLI_OPENCLAW_MJS!==void 0||e.QCLAW_CONFIG_HMAC_SECRET!==void
...[truncated 27 chars]

• Confidence: 95% confidence
• Finding: The script inspects extensive environment variables and caches session/account context, then writes curl-style logs and tracing attributes that may include raw queries, device IDs, request IDs, and file/share metadata. In an agent environment, that can leak surrounding host context and user activity beyond the minimum necessary for Quark Drive operations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_node_linux() {
  if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

• Confidence: 99% confidence
• Finding: Using sudo -E specifically preserves caller environment variables while executing a remote-fed shell as root, increasing the attack surface beyond ordinary sudo usage. In adversarial or misconfigured environments, preserved variables can affect command resolution, network behavior, or script logic during privileged execution.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0
    fi

• Confidence: 97% confidence
• Finding: The installer runs apt-get install with sudo, causing system-wide package changes for a dependency that is not strictly limited to the skill's own directory. While privileged package installs can be legitimate, here they expand blast radius and violate least privilege for a file-drive skill installer.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

fi
  elif command -v yum &>/dev/null; then
    info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
    sudo yum install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

• Confidence: 98% confidence
• Finding: This line pipes remote content directly into sudo bash on yum-based systems, enabling immediate root-level code execution from fetched network data. The risk is especially severe because there is no signature verification, no content review step, and no explicit security warning.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

elif command -v yum &>/dev/null; then
    info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
    sudo yum install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0
    fi

• Confidence: 96% confidence
• Finding: The installer invokes sudo yum install to change system packages globally. Although common in admin workflows, doing this automatically inside a skill installer increases host impact and can unintentionally alter production environments or break dependency expectations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

install_node_linux() {
  if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

• Confidence: 99% confidence
• Finding: Using sudo -E specifically preserves caller environment variables while executing a remote-fed shell as root, increasing the attack surface beyond ordinary sudo usage. In adversarial or misconfigured environments, preserved variables can affect command resolution, network behavior, or script logic during privileged execution.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/auth.md:33