Security audit

agentdrive-cli

Security checks for vulnerabilities and agentic risk

Overview

This cloud-drive skill is coherent, but it needs Review because it runs mutable remote code and can delete cloud data or start persistent backup without mandatory confirmation.

Install only if you trust the npm package publisher and are comfortable granting the agent cloud-drive mutation rights. Prefer a pinned, reviewed CLI version, avoid the HTTP ZIP path, do not paste long-lived API keys into commands, and require explicit confirmation before delete, clear-dir, overwrite, restore, or auto-backup enable operations.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: references/commands.md:621
Finding: Persistent Cross-Session Automatic Backup Daemon<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:64`; `references/commands.md:621-650` **Vulnerability Type**: Persistent background service with continuing filesystem and network access **Risk Level**: High ### Vulnerable Code Snippet ```bash agentdrive claw-auto-backup enable --source-dir <path> --claw-name <name> [--event-log <path>] ``` The associated documentation states that this command starts a detached background daemon, writes a state file, monitors a local directory, and continues running after the terminal session closes. ### Technical Analysis The Skill permits an AI Agent to start a persistent daemon that monitors a local directory and continuously synchronizes changes to cloud storage. The process is deliberately detached from the current shell and survives the Agent session that created it. This crosses the boundary from a one-time cloud-storage operation into persistent system modification. The daemon retains filesystem-read and network-upload capabilities after the immediate task has completed. The Skill does not mandate an expiration time, session-bound shutdown, sensitive-path validation, or a confirmation explaining the continuing behavior. Although the feature is documented and includes a disable command, its cross-session behavior satisfies the definition of system persistence. ### Attack Path 1. A user asks the Agent to back up files or enable automatic backup. 2. The Agent invokes `claw-auto-backup enable` with a local source directory. 3. The CLI creates state and launches a detached background daemon. 4. The initiating terminal or Agent session ends. 5. The daemon continues monitoring the directory. 6. Files subsequently created or modified in that directory are uploaded to cloud storage. 7. If the selected path is overly broad or sensitive, later-created confidential data may be disclosed without further user interaction. ### Impact Assessment The persistent process obtains continuing read access to files ava ...[truncated 499 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed confirmation before starting any persistent process. 2. Display the fully resolved local source path, cloud destination, expected persistence, and shutdown command before activation. 3. Reject filesystem roots, home-directory roots, system configuration directories, credential directories, and other sensitive locations by default. 4. Use a narrow allowlist for directories that may be monitored. 5. Make automatic backup session-bound or time-limited by default. 6. Require a separate explicit option to allow operation after the current session ends. 7. Provide prominent status output containing the daemon PID, monitored paths, cloud destinations, start time, and expiration time. 8. Automatically stop the daemon when authentication expires or when the configured destination becomes invalid. 9. Add a dry-run mode that enumerates files eligible for upload without starting the daemon. 10. Ensure that `disable` reliably terminates the process and removes all associated state. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:11
Finding: Execution of an Unpinned Remote npm Package and Download over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-23`; `references/commands.md:5-23`; `README.md:9-13` **Vulnerability Type**: Unsafe third-party dependency retrieval **Risk Level**: High ### Vulnerable Code Snippets ```bash AGENTDRIVE_CLI='npx -y -p @aicloud360/agentdrive@latest agentdrive' ``` ```bash npx -y -p @aicloud360/agentdrive@latest agentdrive <command> ``` ```bash curl -O http://cn-zhengzhou-3.xstore.qihu.com/yunpan-zz2-pkg/agentdrive-cli-skill.zip ``` ### Technical Analysis The default execution mode uses `npx -y` to retrieve and execute the mutable `latest` version of a third-party npm package. The `-y` option suppresses interactive installation approval, while `latest` allows the executed implementation to change after this Skill has been reviewed. Consequently, auditing the Markdown files does not establish what code will run when the Skill is used. A future package release, compromised publisher account, malicious dependency update, registry compromise, or package takeover could introduce arbitrary executable behavior. The README also offers a ZIP archive through plaintext HTTP without a checksum or signature. An attacker able to alter traffic between the user and the host could substitute the downloaded archive. No integrity validation is performed before installation. ### Attack Path #### Mutable npm package path 1. The user requests an ordinary cloud-drive operation. 2. The Agent constructs the documented `npx -y -p @aicloud360/agentdrive@latest` command. 3. `npx` retrieves whatever package version is currently associated with the `latest` tag. 4. A compromised or malicious release is installed without interactive confirmation. 5. Package code executes with the operating-system privileges and environment of the Agent process. 6. The code may access local files, environment variables, stored cloud credentials, and the network. #### Plaintext archive path 1. A user or automation process executes the documented HTTP ...[truncated 781 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an audited, exact package version. 2. Verify the npm package using a lockfile and expected integrity hash. 3. Avoid automatic `-y` approval for first execution or version changes. 4. Review and publish the executable CLI source corresponding to the pinned release. 5. Use HTTPS exclusively for every archive and installation endpoint. 6. Publish a cryptographic checksum through an independently protected channel and verify it before extraction. 7. Prefer signed release artifacts and validate the publisher signature. 8. Reject redirects from HTTPS to HTTP. 9. Run the CLI in a sandbox with restricted filesystem, environment-variable, credential, and network access. 10. Establish a controlled update process in which new versions are reviewed before the pin is changed. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Cloud API Key Passed through Command-Line Arguments and Persisted without Documented Permission Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-33`; `README.md:49-53`; `references/commands.md:53-59` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code Snippets ```bash $AGENTDRIVE_CLI auth login --api-key <KEY> ``` ```bash npx -y -p @aicloud360/agentdrive@latest agentdrive auth login --api-key <YOUR_API_KEY> ``` ```bash agentdrive auth login --api-key <api_key> [--env <env>] [--sub-channel <channel>] ``` The command reference states that the API key is saved to: ```text ~/.agentdrive/config.json ``` ### Technical Analysis Passing an API key as a command-line argument can expose it through shell history, process listings, terminal recording, CI output, debugging logs, audit telemetry, or Agent transcripts. On systems where process arguments are visible to other users or monitoring software, the secret may be observable while the command is running. The documentation also states that the key is persisted in `~/.agentdrive/config.json`, but it does not specify restrictive file permissions, encryption, use of an operating-system credential store, or validation that the parent directory is not accessible to other users. The project does mention the `API_KEY` environment variable as an alternative, but environment variables can also leak through process environments and logs. Neither documented method provides a dedicated secure secret-input mechanism. ### Attack Path 1. A user supplies an API key to the Agent or directly enters the documented login command. 2. The key appears in the process argument vector and may be stored in shell or Agent history. 3. The CLI writes the key to `~/.agentdrive/config.json`. 4. Another local process, user, log reader, CI operator, or compromised dependency obtains the key from command records, process metadata, or the configuration file. 5. The attacker uses the key to authenticate to the cloud service. 6. The attacker accesses or modifies cloud-drive resou ...[truncated 519 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove command-line API-key examples from the recommended authentication flow. 2. Read secrets using a hidden interactive prompt or a dedicated standard-input option that is not echoed. 3. Integrate with operating-system credential stores or an approved secret manager. 4. Prevent the Agent framework from recording secret-bearing prompts, commands, and outputs. 5. Create `~/.agentdrive` with permissions restricted to its owner. 6. Create the configuration file atomically with owner-only permissions, such as `0600` on Unix-like systems. 7. Validate existing file ownership and permissions before reading or writing credentials. 8. Avoid returning any portion of the key unless necessary, even when nominally masked. 9. Document key rotation, expiration, revocation, and least-privilege scope. 10. Redact secrets from errors, telemetry, debug output, and CI logs. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/commands.md:339
Finding: Irreversible Cloud Deletion without a Mandatory Confirmation or Dry Run<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8,52`; `references/commands.md:339-356` **Vulnerability Type**: Unsafe destructive operation **Risk Level**: High ### Vulnerable Code Snippet ```bash agentdrive file clear-dir <path> ``` The Skill maps requests for clearing a directory directly to this command. The command reference explicitly states that it clears the files inside the directory without moving them to a recycle bin. The Skill's general execution instruction also directs the Agent to execute the command most appropriate to the user's intent rather than first presenting all available commands. No mandatory exception is defined for irreversible operations. ### Technical Analysis `file clear-dir` performs permanent deletion of directory contents while preserving the directory itself. The documentation warns users to be careful, but the Skill does not require: - Explicit confirmation immediately before execution. - A listing or preview of affected objects. - A dry run. - Exact path resolution and display. - Protection for root or high-value directories. - Recoverable deletion. - A maximum deletion count. A warning in reference documentation is insufficient when the controlling Skill instructs an autonomous Agent to execute the most appropriate command directly. Ambiguous natural-language requests, an incorrectly constructed path, stale context, or manipulated external content could therefore trigger irreversible data loss. ### Attack Path 1. The user provides an ambiguous request to clean, empty, reset, or remove content from a cloud directory. 2. The Agent maps the request to `file clear-dir`. 3. The Agent constructs an incorrect, overly broad, or unintended cloud path. 4. The command executes without a mandatory target preview or confirmation. 5. Every file under the selected directory is removed without entering a recycle bin. 6. The user cannot recover the data through normal undelete functionality. A second path is possib ...[truncated 661 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit confirmation for `clear-dir`, deletion, overwrite, and transfer-with-delete operations. 2. Present the normalized absolute cloud path before confirmation. 3. List the number, names, and total size of affected objects. 4. Require the user to repeat or approve the exact target path for high-impact operations. 5. Add a dry-run mode and make it the default for Agent-driven execution. 6. Reject clearing the cloud root and other protected directories. 7. Enforce configurable deletion-count and total-size limits. 8. Prefer moving content to a recycle bin or quarantine directory with a retention period. 9. Use short-lived authorization specifically scoped to the confirmed destructive operation. 10. Record a non-secret audit event containing the confirmed target and result. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (36)

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 3. 将 agentdrive-cli-skill 移动到你的主 skills 目录，并清理无用文件 mv .skills/ecs-yunpan-skills/agentdrive-cli-skill .skills/ rm -rf .skills/ecs-yunpan-skills ``` 执行完毕后，你的本地结构应当如下：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

Category: analysis-evasion
Content: **详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: **详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > **注意**：多文件时 `|` 必须在引号内。含大量文件时推荐用 `--batch` + stdin 管道，可彻底绕开 `|` 转义问题。 > ```bash > # 删除文件 > agentdrive file rm /临时/a.txt > # 删除目录（两种写法均可） > agentdrive file rm /bbb/mydir/ > agentdrive file rm /bbb/mydir
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 删除文件 > agentdrive file rm /临时/a.txt > # 删除目录（两种写法均可） > agentdrive file rm /bbb/mydir/ > agentdrive file rm /bbb/mydir > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt"
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > agentdrive file rm /临时/a.txt > # 删除目录（两种写法均可） > agentdrive file rm /bbb/mydir/ > agentdrive file rm /bbb/mydir > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > agentdrive file rm /bbb/mydir/ > agentdrive file rm /bbb/mydir > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ```
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: > # 多文件（加引号） > agentdrive file rm "/临时/a.txt|/临时/b.txt" > # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合） > cat paths.txt | agentdrive file rm /临时/e.txt --batch > ``` > > **Windows 提示**：
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 1. 创建你的 skills 存放目录（以 .skills 为例） mkdir -p .skills # 2. 将包含该 skill 的仓库拉取到本地 git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash # 1. 创建你的 skills 存放目录(以 .skills 为例) mkdir -p .skills # 2. 将包含该 skill 的仓库拉取到本地 git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Passing an API key directly on the command line can expose the credential through shell history, process listings, CI logs, and telemetry. The README provides this pattern without any warning or safer alternative, increasing the chance that users leak long-lived secrets.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README tells users to execute `npx -y -p @aicloud360/agentdrive@latest ...`, which pulls and runs a package dynamically at install/use time without pinning a specific version or integrity. That creates a supply-chain risk: if the package is compromised or a bad update is published, users may execute unreviewed code immediately.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells the agent to directly execute the most suitable command and includes destructive operations such as delete, clear-dir, move, rename, and overwrite-capable actions, but provides no confirmation or safety gating guidance. In a cloud-storage context, this increases the chance of irreversible data loss from ambiguous prompts, misclassification of user intent, or prompt injection via surrounding context.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill defaults to executing `npx -y -p @aicloud360/agentdrive@latest agentdrive`, which fetches and runs the newest package version at execution time. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking change could cause arbitrary code execution in the agent environment without review.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The Windows example invokes `npx -y -p @aicloud360/agentdrive@latest agentdrive`, again causing dynamic package retrieval and execution. Example commands in skills are often copied verbatim, so this materially propagates the same supply-chain execution risk to users and automation.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This PowerShell example also uses `@latest`, meaning execution depends on whatever package version is published at runtime. In CI or agent contexts, that can silently introduce unreviewed code and lead to arbitrary command execution or data exposure.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This example pipes local configuration data into a package fetched with `@latest`, combining sensitive input handling with unpinned runtime code. If the package supply chain is compromised, configuration contents or host access could be abused during execution.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The PowerShell config example repeats the unpinned `@latest` pattern, exposing configuration-writing workflows to supply-chain compromise. Because these commands process structured config content, a malicious package could tamper with or exfiltrate that data.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This command appends local file contents through a package resolved at runtime via `@latest`. That gives a remote package publisher an opportunity to influence code executed in the local environment while handling potentially sensitive file content.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The PowerShell append example continues the same pattern of running unpinned remote code while ingesting local file contents. In an agent or automation environment, that expands the blast radius from a package compromise to host data and cloud-storage actions.

Static analysis

No suspicious patterns detected.