Baidunetdisk Skill

• Analyzed: May 12, 2026, 4:07 AM
• Findings: 1
• Version: 1.0.2
• Hash: 188d3e33346daf911b83f22dff95f410ae3e881d832ce69884fe3bcc58c777d2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its requirement for highly sensitive Baidu Netdisk credentials (BDUSS and STOKEN) which grant full access to the user's cloud storage, including irreversible deletion capabilities. While the `SKILL.md` documentation transparently warns the user about these risks and the `scripts/main.py` code appears to implement only the stated functionalities without evidence of malicious intent (e.g., no unauthorized data exfiltration, no shell injection vulnerabilities, no persistence mechanisms), the inherent high-risk nature of these permissions and operations warrants a 'suspicious' classification rather than 'benign'. There are no prompt injection attempts against the agent.