agentdrive-cli

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This cloud-drive skill is coherent, but it needs Review because it runs mutable remote code and can delete cloud data or start persistent backup without mandatory confirmation.

Install only if you trust the npm package publisher and are comfortable granting the agent cloud-drive mutation rights. Prefer a pinned, reviewed CLI version, avoid the HTTP ZIP path, do not paste long-lived API keys into commands, and require explicit confirmation before delete, clear-dir, overwrite, restore, or auto-backup enable operations.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: references/commands.md:621

Finding

Persistent Cross-Session Automatic Backup Daemon

Content

View full analysis

--claw-name [--event-log ] ``` The associated documentation states that this command starts a detached background daemon, writes a state file, monitors a local directory, and continues running after the terminal session closes. ### Technical Analysis The Skill permits an AI Agent to start a persistent daemon that monitors a local directory and continuously synchronizes changes to cloud storage. The process is deliberately detached from the current shell and survives the Agent session that created it. This crosses the boundary from a one-time cloud-storage operation into persistent system modification. The daemon retains filesystem-read and network-upload capabilities after the immediate task has completed. The Skill does not mandate an expiration time, session-bound shutdown, sensitive-path validation, or a confirmation explaining the continuing behavior. Although the feature is documented and includes a disable command, its cross-session behavior satisfies the definition of system persistence. ### Attack Path 1. A user asks the Agent to back up files or enable automatic backup. 2. The Agent invokes `claw-auto-backup enable` with a local source directory. 3. The CLI creates state and launches a detached background daemon. 4. The initiating terminal or Agent session ends. 5. The daemon continues monitoring the directory. 6. Files subsequently created or modified in that directory are uploaded to cloud storage. 7. If the selected path is overly broad or sensitive, later-created confidential data may be disclosed without further user interaction. ### Impact Assessment The persistent process obtains continuing read access to files ava ...[truncated 499 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11

Finding

Execution of an Unpinned Remote npm Package and Download over Plaintext HTTP

Content

View full analysis

``` ```bash curl -O http://cn-zhengzhou-3.xstore.qihu.com/yunpan-zz2-pkg/agentdrive-cli-skill.zip ``` ### Technical Analysis The default execution mode uses `npx -y` to retrieve and execute the mutable `latest` version of a third-party npm package. The `-y` option suppresses interactive installation approval, while `latest` allows the executed implementation to change after this Skill has been reviewed. Consequently, auditing the Markdown files does not establish what code will run when the Skill is used. A future package release, compromised publisher account, malicious dependency update, registry compromise, or package takeover could introduce arbitrary executable behavior. The README also offers a ZIP archive through plaintext HTTP without a checksum or signature. An attacker able to alter traffic between the user and the host could substitute the downloaded archive. No integrity validation is performed before installation. ### Attack Path #### Mutable npm package path 1. The user requests an ordinary cloud-drive operation. 2. The Agent constructs the documented `npx -y -p @aicloud360/agentdrive@latest` command. 3. `npx` retrieves whatever package version is currently associated with the `latest` tag. 4. A compromised or malicious release is installed without interactive confirmation. 5. Package code executes with the operating-system privileges and environment of the Agent process. 6. The code may access local files, environment variables, stored cloud credentials, and the network. #### Plaintext archive path 1. A user or automation process executes the documented HTTP ...[truncated 781 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:26

Finding

Cloud API Key Passed through Command-Line Arguments and Persisted without Documented Permission Controls

Content

View full analysis

``` ```bash npx -y -p @aicloud360/agentdrive@latest agentdrive auth login --api-key ``` ```bash agentdrive auth login --api-key [--env ] [--sub-channel ] ``` The command reference states that the API key is saved to: ```text ~/.agentdrive/config.json ``` ### Technical Analysis Passing an API key as a command-line argument can expose it through shell history, process listings, terminal recording, CI output, debugging logs, audit telemetry, or Agent transcripts. On systems where process arguments are visible to other users or monitoring software, the secret may be observable while the command is running. The documentation also states that the key is persisted in `~/.agentdrive/config.json`, but it does not specify restrictive file permissions, encryption, use of an operating-system credential store, or validation that the parent directory is not accessible to other users. The project does mention the `API_KEY` environment variable as an alternative, but environment variables can also leak through process environments and logs. Neither documented method provides a dedicated secure secret-input mechanism. ### Attack Path 1. A user supplies an API key to the Agent or directly enters the documented login command. 2. The key appears in the process argument vector and may be stored in shell or Agent history. 3. The CLI writes the key to `~/.agentdrive/config.json`. 4. Another local process, user, log reader, CI operator, or compromised dependency obtains the key from command records, process metadata, or the configuration file. 5. The attacker uses the key to authenticate to the cloud service. 6. The attacker accesses or modifies cloud-drive resou ...[truncated 519 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/commands.md:339

Finding

Irreversible Cloud Deletion without a Mandatory Confirmation or Dry Run

Content

View full analysis

``` The Skill maps requests for clearing a directory directly to this command. The command reference explicitly states that it clears the files inside the directory without moving them to a recycle bin. The Skill's general execution instruction also directs the Agent to execute the command most appropriate to the user's intent rather than first presenting all available commands. No mandatory exception is defined for irreversible operations. ### Technical Analysis `file clear-dir` performs permanent deletion of directory contents while preserving the directory itself. The documentation warns users to be careful, but the Skill does not require: - Explicit confirmation immediately before execution. - A listing or preview of affected objects. - A dry run. - Exact path resolution and display. - Protection for root or high-value directories. - Recoverable deletion. - A maximum deletion count. A warning in reference documentation is insufficient when the controlling Skill instructs an autonomous Agent to execute the most appropriate command directly. Ambiguous natural-language requests, an incorrectly constructed path, stale context, or manipulated external content could therefore trigger irreversible data loss. ### Attack Path 1. The user provides an ambiguous request to clean, empty, reset, or remove content from a cloud directory. 2. The Agent maps the request to `file clear-dir`. 3. The Agent constructs an incorrect, overly broad, or unintended cloud path. 4. The command executes without a mandatory target preview or confirmation. 5. Every file under the selected directory is removed without entering a recycle bin. 6. The user cannot recover the data through normal undelete functionality. A second path is possib ...[truncated 661 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (36)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

3. 将 agentdrive-cli-skill 移动到你的主 skills 目录，并清理无用文件

mv .skills/ecs-yunpan-skills/agentdrive-cli-skill .skills/ rm -rf .skills/ecs-yunpan-skills

text

执行完毕后，你的本地结构应当如下：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

**详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

**详细的命令参数说明，请按需查阅 [references/commands.md](references/commands.md)。**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 229)May include surrounding context.

md

> **注意**：多文件时 `|` 必须在引号内。含大量文件时推荐用 `--batch` + stdin 管道，可彻底绕开 `|` 转义问题。
> ```bash
> # 删除文件
> agentdrive file rm /临时/a.txt
> # 删除目录（两种写法均可）
> agentdrive file rm /bbb/mydir/
> agentdrive file rm /bbb/mydir

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 231)May include surrounding context.

md

> # 删除文件
> agentdrive file rm /临时/a.txt
> # 删除目录（两种写法均可）
> agentdrive file rm /bbb/mydir/
> agentdrive file rm /bbb/mydir
> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 232)May include surrounding context.

md

> agentdrive file rm /临时/a.txt
> # 删除目录（两种写法均可）
> agentdrive file rm /bbb/mydir/
> agentdrive file rm /bbb/mydir
> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 234)May include surrounding context.

md

> agentdrive file rm /bbb/mydir/
> agentdrive file rm /bbb/mydir
> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 236)May include surrounding context.

md

> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 242)May include surrounding context.

md

> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 243)May include surrounding context.

md

> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 680)May include surrounding context.

md

> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 681)May include surrounding context.

md

> # 多文件（加引号）
> agentdrive file rm "/临时/a.txt|/临时/b.txt"
> # 批量删除（macOS/Linux：stdin 管道，推荐；支持文件与目录混合）
> cat paths.txt | agentdrive file rm /临时/e.txt --batch
> ```
>
> **Windows 提示**：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# 1. 创建你的 skills 存放目录（以 .skills 为例）
mkdir -p .skills

# 2. 将包含该 skill 的仓库拉取到本地
git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash

# 1. 创建你的 skills 存放目录(以 .skills 为例)
mkdir -p .skills

# 2. 将包含该 skill 的仓库拉取到本地
git clone https://github.com/yifangyun/ecs-yunpan-skills.git .skills/ecs-yunpan-skills

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Passing an API key directly on the command line can expose the credential through shell history, process listings, CI logs, and telemetry. The README provides this pattern without any warning or safer alternative, increasing the chance that users leak long-lived secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README tells users to execute npx -y -p @aicloud360/agentdrive@latest ..., which pulls and runs a package dynamically at install/use time without pinning a specific version or integrity. That creates a supply-chain risk: if the package is compromised or a bad update is published, users may execute unreviewed code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells the agent to directly execute the most suitable command and includes destructive operations such as delete, clear-dir, move, rename, and overwrite-capable actions, but provides no confirmation or safety gating guidance. In a cloud-storage context, this increases the chance of irreversible data loss from ambiguous prompts, misclassification of user intent, or prompt injection via surrounding context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill defaults to executing npx -y -p @aicloud360/agentdrive@latest agentdrive, which fetches and runs the newest package version at execution time. This creates a supply-chain risk: a compromised publisher account, malicious release, or breaking change could cause arbitrary code execution in the agent environment without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The Windows example invokes npx -y -p @aicloud360/agentdrive@latest agentdrive, again causing dynamic package retrieval and execution. Example commands in skills are often copied verbatim, so this materially propagates the same supply-chain execution risk to users and automation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This PowerShell example also uses @latest, meaning execution depends on whatever package version is published at runtime. In CI or agent contexts, that can silently introduce unreviewed code and lead to arbitrary command execution or data exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This example pipes local configuration data into a package fetched with @latest, combining sensitive input handling with unpinned runtime code. If the package supply chain is compromised, configuration contents or host access could be abused during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The PowerShell config example repeats the unpinned @latest pattern, exposing configuration-writing workflows to supply-chain compromise. Because these commands process structured config content, a malicious package could tamper with or exfiltrate that data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This command appends local file contents through a package resolved at runtime via @latest. That gives a remote package publisher an opportunity to influence code executed in the local environment while handling potentially sensitive file content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The PowerShell append example continues the same pattern of running unpinned remote code while ingesting local file contents. In an agent or automation environment, that expands the blast radius from a package compromise to host data and cloud-storage actions.

Content

No source excerpt is available for this finding.