360disk-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.1.1

Overview

The skill is a real cloud-disk CLI helper, but it needs Review because it runs an unpinned external npm package by default while handling cloud credentials and powerful local/cloud file operations.

Install only if you are comfortable letting an external npm CLI manage your 360 AI Cloud Disk and, for backup features, read or write selected local directories. Prefer a pinned reviewed CLI version, avoid the HTTP ZIP install path, do not paste API keys into chat or shell commands when a safer secret method is available, and require explicit confirmation before delete, clear-dir, restore, share, or auto-backup actions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

``` ### Technical Analysis The Skill instructs the Agent to use `npx -y` with the mutable `@latest` package tag as its default execution mode. Each invocation may retrieve and execute a package version that did not exist when the Skill was reviewed. The `-y` option suppresses the normal installation confirmation, while `@latest` prevents the executing package from being tied to a reviewed version. The actual CLI implementation is not included in this project, so its code execution, network destinations, credential processing, and local file access cannot be verified through this audit. This creates a remote payload execution channel: control of the npm package, its publisher account, or the applicable registry response is sufficient to change the code executed by the Agent without changing the audited Skill files. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the `latest` tag. 3. A user asks the Agent to perform a documented cloud-disk operation. 4. The Agent invokes the configured `npx -y -p ...@latest` command. 5. `npx` downloads and executes the malicious package without interactive approval. 6. The package runs with the privileges and environment of the Agent process. 7. It can attempt to read accessible local files, environment variables, stored cloud credentials, and command input, or alter local and remote ...[truncated 737 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Skill Archive Is Downloaded over Plaintext HTTP Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:49

Finding

Cloud API Key Is Passed Through Command-Line Arguments

Content

View full analysis

``` The authentication instructions in the command reference also use the same pattern: ```bash 360disk auth login --api-key [--env ] [--sub-channel ] ``` ### Technical Analysis The documentation recommends supplying the cloud API key as a command-line argument. After a user replaces the placeholder with a real credential, the key may be exposed through several operating-system and operational channels: - Shell history files. - Process-list or process-inspection interfaces. - Terminal capture and session recording. - CI/CD command logs. - Agent tool-call logs and conversation transcripts. - Error reports that include the original command. The documentation also states that authentication information is saved to `~/.360disk/config.json`, but it does not specify restrictive file permissions or other local credential protections. ### Attack Path 1. A user enters or gives the Agent a real cloud API key. 2. The Agent constructs the documented command with the key in `--api-key`. 3. The command is recorded in shell history, an Agent transcript, CI output, terminal logs, or process metadata. 4. Another local user, log reader, support operator, compromised process, or transcript recipient retrieves the exposed value. 5. The attacker uses the API key to authenticate to the associated cloud-disk account. 6. The attacker performs operations permitted by that credential, such as listing, downloading, uploading, moving, deleting, or sharing files. A second exposure path exists if the persisted configuration file is readable by unauthorized local accounts or processes. ### ...[truncated 567 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

3. 将 360-ai-cloud-disk-cli-skill 移动到你的主 skills 目录，并清理无用文件

mv .skills/ecs-yunpan-skills/360-ai-cloud-disk-cli-skill .skills/ rm -rf .skills/ecs-yunpan-skills

text

执行完毕后，你的本地结构应当如下：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

**详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

**详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 229)May include surrounding context.

md

> **注意**：多文件时 `|` 必须在引号内。含大量文件时推荐用 `--batch` + stdin 管道，可彻底绕开 `|` 转义问题。
> ```bash
> # 删除文件
> 360disk file rm /临时/a.txt
> # 删除目录（两种写法均可）
> 360disk file rm /bbb/mydir/
> 360disk file rm /bbb/mydir

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 231)May include surrounding context.

md

> # 删除文件
> 360disk file rm /临时/a.txt
> # 删除目录（两种写法均可）
> 360disk file rm /bbb/mydir/
> 360disk file rm /bbb/mydir
> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 232)May include surrounding context.

md

> 360disk file rm /临时/a.txt
> # 删除目录（两种写法均可）
> 360disk file rm /bbb/mydir/
> 360disk file rm /bbb/mydir
> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 234)May include surrounding context.

md

> 360disk file rm /bbb/mydir/
> 360disk file rm /bbb/mydir
> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 236)May include surrounding context.

md

> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.

md

> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 243)May include surrounding context.

md

> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 680)May include surrounding context.

md

> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 681)May include surrounding context.

md

> # 多文件（加引号）
> 360disk file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | 360disk file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# 1. 创建你的 skills 存放目录（以 .skills 为例）
mkdir -p .skills

# 2. 将包含该 skill 的仓库拉取到本地
git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# 1. 创建你的 skills 存放目录(以 .skills 为例)
mkdir -p .skills

# 2. 将包含该 skill 的仓库拉取到本地
git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README tells users to supply an API key directly on the command line, which can expose the credential through shell history, process listings, CI logs, or telemetry collected by terminal tooling. Because this skill is intended for agents, scripts, and CI usage, the chance of accidental credential leakage is materially higher than for one-off manual use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication section tells the agent to run login with an inline API key and describes credential precedence, but gives no warning against exposing secrets in shell history, logs, process listings, CI output, or persisted config files. In a CLI skill intended for scripting and automation, this omission materially increases the chance of credential leakage and subsequent unauthorized access to the user's cloud storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents destructive operations such as delete, clear-dir, logout/clear local config, and bulk deletion via stdin, but provides no requirement for confirmation, dry-run, scope validation, or user warning before execution. Because the skill also instructs the agent to directly execute the most appropriate command, an agent could perform irreversible cloud data loss from an ambiguous or mistaken prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete command documents destructive examples and batch deletion workflows, but the warning is not prominent enough for an agentic context where commands may be generated and run without human review. Because deletion can target files or directories and batch mode reads arbitrary paths from stdin, a mistaken or overbroad invocation could cause irreversible cloud data loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata frames the tool as cloud-disk management, but the command reference also exposes local filesystem backup/restore, real-time directory watching, background daemon behavior, and local state via an incremental SQLite database. This materially expands the capability surface into persistent local-data access and exfiltration/synchronization, which is security-relevant because an agent or user may invoke it under the mistaken assumption that it only touches remote cloud files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The restore command writes cloud content recursively to a local target path but does not warn about overwriting, merging, or otherwise modifying local files. In an automation setting, this can unexpectedly clobber local workspaces or place untrusted remote content onto the host filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The validation step instructs the agent to list the cloud root directory without warning that file names and metadata may be disclosed to the agent or logged by the host platform. This is a real privacy concern, though lower severity, because the action is expected for a cloud-storage skill and does not by itself expand privileges beyond the user-authorized account.

Content

No source excerpt is available for this finding.