Security audit

360disk-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real cloud-disk CLI helper, but it needs Review because it runs an unpinned external npm package by default while handling cloud credentials and powerful local/cloud file operations.

Install only if you are comfortable letting an external npm CLI manage your 360 AI Cloud Disk and, for backup features, read or write selected local directories. Prefer a pinned reviewed CLI version, avoid the HTTP ZIP install path, do not paste API keys into chat or shell commands when a safer secret method is available, and require explicit confirmation before delete, clear-dir, restore, share, or auto-backup actions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:13
Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-15` **Additional Locations**: `README.md:52`; `references/commands.md:6-8,20-23`; `SKILL.md:112-133` **Vulnerability Type**: Remote payload retrieval and execution through an unpinned npm dependency **Risk Level**: High ```bash DISK_360_CLI='npx -y -p @aicloud360/360-ai-cloud-disk-cli@latest 360disk' ``` The same execution pattern is also presented directly: ```bash npx -y -p @aicloud360/360-ai-cloud-disk-cli@latest 360disk <command> ``` ### Technical Analysis The Skill instructs the Agent to use `npx -y` with the mutable `@latest` package tag as its default execution mode. Each invocation may retrieve and execute a package version that did not exist when the Skill was reviewed. The `-y` option suppresses the normal installation confirmation, while `@latest` prevents the executing package from being tied to a reviewed version. The actual CLI implementation is not included in this project, so its code execution, network destinations, credential processing, and local file access cannot be verified through this audit. This creates a remote payload execution channel: control of the npm package, its publisher account, or the applicable registry response is sufficient to change the code executed by the Agent without changing the audited Skill files. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the `latest` tag. 3. A user asks the Agent to perform a documented cloud-disk operation. 4. The Agent invokes the configured `npx -y -p ...@latest` command. 5. `npx` downloads and executes the malicious package without interactive approval. 6. The package runs with the privileges and environment of the Agent process. 7. It can attempt to read accessible local files, environment variables, stored cloud credentials, and command input, or alter local and remote ...[truncated 737 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version: ```bash npx -p @aicloud360/360-ai-cloud-disk-cli@1.2.3 360disk ``` 2. Do not use `-y` for first-time installation or upgrades; require explicit user approval. 3. Pin and verify the package integrity hash through a lockfile or another authenticated integrity mechanism. 4. Document the expected npm registry and prevent untrusted registry overrides. 5. Separate package installation from command execution so that installation can be reviewed and approved once. 6. Perform upgrades through an explicit process that reviews release provenance and package contents before changing the pinned version. 7. Run the CLI in a least-privilege sandbox with access only to the local files required for the requested operation. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:10
Finding: Skill Archive Is Downloaded over Plaintext HTTP Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md:10-13` **Vulnerability Type**: Unauthenticated and integrity-unprotected dependency download **Risk Level**: Medium ```bash curl -O http://cn-zhengzhou-3.xstore.qihu.com/yunpan-zz2-pkg/360-ai-cloud-disk-cli-skill.zip ``` ### Technical Analysis The documented quick-download command retrieves the Skill archive over plaintext HTTP. HTTP does not authenticate the server or protect the response from modification in transit. The instructions do not provide a SHA-256 checksum, digital signature, or another independent integrity check. Consequently, the downloaded archive cannot be reliably distinguished from an archive modified by a network attacker, compromised proxy, malicious access point, or compromised download host. Because the archive is intended to be installed into an Agent's Skill directory, modified Skill instructions or added executable files may be trusted and loaded in later Agent sessions. ### Attack Path 1. A user or automated installer runs the documented `curl` command. 2. An attacker capable of intercepting or modifying the HTTP connection replaces the ZIP response. 3. The substituted archive contains altered Skill instructions or additional malicious files. 4. The user extracts or installs the archive into the Agent's Skill directory. 5. The Agent loads the modified Skill as trusted local content. 6. The injected instructions can direct the Agent to execute attacker-controlled commands, retrieve additional payloads, or disclose data accessible in the Agent session. ### Impact Assessment The immediate impact is arbitrary modification of the downloaded Skill package. If the altered package is installed and loaded, the attacker may gain influence over Agent behavior and potentially obtain code execution with the Agent's privileges. The resulting scope can include: - Manipulation of current Agent instructions. - Execution of commands available to the Agent. - Access to local fil ...[truncated 287 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the HTTP URL with an HTTPS URL hosted on an authenticated domain. 2. Publish a cryptographic checksum for each immutable release: ```bash curl -O https://example.invalid/360-ai-cloud-disk-cli-skill.zip echo "EXPECTED_SHA256 360-ai-cloud-disk-cli-skill.zip" | sha256sum -c - ``` 3. Prefer a digitally signed release and verify the signature against a separately distributed, trusted public key. 4. Use versioned, immutable archive names instead of a mutable generic ZIP name. 5. Require the installation process to abort when certificate, checksum, or signature verification fails. 6. Do not extract or load the archive until integrity verification has completed successfully. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:49
Finding: Cloud API Key Is Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `README.md:49-53` **Additional Locations**: `SKILL.md:27-32`; `references/commands.md:54-58` **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: Medium ```bash npx -y -p @aicloud360/360-ai-cloud-disk-cli@latest 360disk auth login --api-key <YOUR_API_KEY> ``` The authentication instructions in the command reference also use the same pattern: ```bash 360disk auth login --api-key <api_key> [--env <env>] [--sub-channel <channel>] ``` ### Technical Analysis The documentation recommends supplying the cloud API key as a command-line argument. After a user replaces the placeholder with a real credential, the key may be exposed through several operating-system and operational channels: - Shell history files. - Process-list or process-inspection interfaces. - Terminal capture and session recording. - CI/CD command logs. - Agent tool-call logs and conversation transcripts. - Error reports that include the original command. The documentation also states that authentication information is saved to `~/.360disk/config.json`, but it does not specify restrictive file permissions or other local credential protections. ### Attack Path 1. A user enters or gives the Agent a real cloud API key. 2. The Agent constructs the documented command with the key in `--api-key`. 3. The command is recorded in shell history, an Agent transcript, CI output, terminal logs, or process metadata. 4. Another local user, log reader, support operator, compromised process, or transcript recipient retrieves the exposed value. 5. The attacker uses the API key to authenticate to the associated cloud-disk account. 6. The attacker performs operations permitted by that credential, such as listing, downloading, uploading, moving, deleting, or sharing files. A second exposure path exists if the persisted configuration file is readable by unauthorized local accounts or processes. ### ...[truncated 567 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a secure interactive prompt that reads the key without echoing it and does not place it in process arguments. 2. Alternatively, read the key from protected standard input or integrate with an operating-system credential store or secret manager. 3. In Agent workflows, instruct users not to paste API keys into chat or other recorded conversations. 4. Prevent authentication commands and secrets from being written to shell history, terminal recordings, CI logs, and Agent tool logs. 5. Redact API-key values from errors and diagnostic output. 6. Store persisted credentials with owner-only permissions, such as mode `0600` for `~/.360disk/config.json`, and verify the owning directory is not accessible to other users. 7. Support short-lived, narrowly scoped credentials and provide documented key rotation and revocation procedures. 8. If environment variables remain supported, clarify that they can also be exposed to child processes and diagnostics and should be supplied through the platform's protected secret facility. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 3. 将 360-ai-cloud-disk-cli-skill 移动到你的主 skills 目录，并清理无用文件 mv .skills/ecs-yunpan-skills/360-ai-cloud-disk-cli-skill .skills/ rm -rf .skills/ecs-yunpan-skills ``` 执行完毕后，你的本地结构应当如下：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

Category: analysis-evasion
Content: **详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: **详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > **注意**：多文件时 `|` 必须在引号内。含大量文件时推荐用 `--batch` + stdin 管道，可彻底绕开 `|` 转义问题。 > ```bash > # 删除文件 > 360disk file rm /临时/a.txt > # 删除目录（两种写法均可） > 360disk file rm /bbb/mydir/ > 360disk file rm /bbb/mydir
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 删除文件 > 360disk file rm /临时/a.txt > # 删除目录（两种写法均可） > 360disk file rm /bbb/mydir/ > 360disk file rm /bbb/mydir > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt"
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > 360disk file rm /临时/a.txt > # 删除目录（两种写法均可） > 360disk file rm /bbb/mydir/ > 360disk file rm /bbb/mydir > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > 360disk file rm /bbb/mydir/ > 360disk file rm /bbb/mydir > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ```
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > 360disk file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | 360disk file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 1. 创建你的 skills 存放目录（以 .skills 为例） mkdir -p .skills # 2. 将包含该 skill 的仓库拉取到本地 git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 1. 创建你的 skills 存放目录(以 .skills 为例) mkdir -p .skills # 2. 将包含该 skill 的仓库拉取到本地 git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README tells users to supply an API key directly on the command line, which can expose the credential through shell history, process listings, CI logs, or telemetry collected by terminal tooling. Because this skill is intended for agents, scripts, and CI usage, the chance of accidental credential leakage is materially higher than for one-off manual use.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The authentication section tells the agent to run login with an inline API key and describes credential precedence, but gives no warning against exposing secrets in shell history, logs, process listings, CI output, or persisted config files. In a CLI skill intended for scripting and automation, this omission materially increases the chance of credential leakage and subsequent unauthorized access to the user's cloud storage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly documents destructive operations such as delete, clear-dir, logout/clear local config, and bulk deletion via stdin, but provides no requirement for confirmation, dry-run, scope validation, or user warning before execution. Because the skill also instructs the agent to directly execute the most appropriate command, an agent could perform irreversible cloud data loss from an ambiguous or mistaken prompt.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The delete command documents destructive examples and batch deletion workflows, but the warning is not prominent enough for an agentic context where commands may be generated and run without human review. Because deletion can target files or directories and batch mode reads arbitrary paths from stdin, a mistaken or overbroad invocation could cause irreversible cloud data loss.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata frames the tool as cloud-disk management, but the command reference also exposes local filesystem backup/restore, real-time directory watching, background daemon behavior, and local state via an incremental SQLite database. This materially expands the capability surface into persistent local-data access and exfiltration/synchronization, which is security-relevant because an agent or user may invoke it under the mistaken assumption that it only touches remote cloud files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The restore command writes cloud content recursively to a local target path but does not warn about overwriting, merging, or otherwise modifying local files. In an automation setting, this can unexpectedly clobber local workspaces or place untrusted remote content onto the host filesystem.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The validation step instructs the agent to list the cloud root directory without warning that file names and metadata may be disclosed to the agent or logged by the host platform. This is a real privacy concern, though lower severity, because the action is expected for a cloud-storage skill and does not by itself expand privileges beyond the user-authorized account.

Static analysis

No suspicious patterns detected.