baidunetdisk

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:40 PM UTC
• Version: 1.0.1

Overview

This Baidu Netdisk skill is purpose-aligned, but it deserves Review because it uses full-account session credentials and can immediately modify or delete cloud files without built-in confirmation.

Install only in a trusted environment and preferably with a dedicated Baidu Netdisk test account. Treat BDUSS and STOKEN like full account passwords, avoid committing config.json, restrict file permissions, and do not let an agent invoke delete, rename, move, or transfer unless you have reviewed the exact path and action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:329

Finding

Plaintext Storage of Full-Account Session Credentials and Broken Environment Fallback

Content

View full analysis

Vulnerability Details

File Location: config.json:1-5, scripts/main.py:329-341, SKILL.md:40-47, README.md:23-31
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

config.json:1-5:

json

{
  "bduss": "",
  "stoken": "",
  "default_save_path": "~/Downloads/BaiduNetdisk"
}

scripts/main.py:329-341:

python

# 读取配置
config_path = os.path.join(os.path.dirname(__file__), '..', 'config.json')
try:
    with open(config_path, 'r') as f:
        config = json.load(f)
except:
    config = {}

bduss = config.get('bduss', os.getenv('BAIDU_BDUSS', ''))
stoken = config.get('stoken', os.getenv('BAIDU_STOKEN', ''))

if not bduss or not stoken:

SKILL.md:40-47:

json

{
  "bduss": "your_bduss_here",
  "stoken": "your_stoken_here",
  "default_save_path": "~/Downloads/BaiduNetdisk"
}

Technical Analysis

The documentation encourages users to place Baidu BDUSS and STOKEN session credentials in a repository-local plaintext JSON file. These are highly sensitive session credentials with broad access to the user's Baidu Netdisk account.

Although environment variables are documented as a safer alternative, the fallback implementation is defective when the shipped configuration retains empty strings. Python's dict.get(key, default) returns the existing empty string rather than evaluating the environment-variable default. Consequently, setting BAIDU_BDUSS and BAIDU_STOKEN alone does not work while the corresponding empty keys remain in config.json.

The credentials are transmitted only to fixed HTTPS endpoints under pan.baidu.com, which is necessary for the declared functionality and is not evidence of unrelated exfiltration. The vulnerability concerns their local storage and handling before transmission.

Attack Path

1. A user follows the installation documentation and writes valid BDUSS and ` ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Correct the fallback logic so empty configuration values do not override environment variables:

   python

   bduss = config.get('bduss') or os.getenv('BAIDU_BDUSS', '')
   stoken = config.get('stoken') or os.getenv('BAIDU_STOKEN', '')
   

2. Prefer a platform secret manager or the host framework's secret-injection mechanism over repository-local files.

3. Replace the distributed config.json with a non-secret config.example.json.

4. Add the real credential file to .gitignore and any package-publication exclusion list.

5. If file-based secrets must be supported, verify that the file is owned by the current user and has restrictive permissions, such as mode 0600 on supported platforms.

6. Reject symlinked or unexpectedly located configuration files where practical.

7. Avoid printing credentials or including them in exception messages and diagnostic logs.

8. Document credential revocation and rotation procedures for users who suspect exposure.

T08 · Insecure Dependencies

Note

• Location: README.md:16

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:16-19, SKILL.md:32-35
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Low

Vulnerable Code

README.md:16-19:

bash

pip install requests tqdm

SKILL.md:32-35:

bash

pip install requests

Technical Analysis

The installation instructions resolve mutable latest versions of third-party packages without version constraints, hashes, or a lock file. This prevents users from reliably installing the same reviewed dependency set and allows future releases to change the effective runtime behavior without changes to the Skill package.

The README.md also directs users to install tqdm, but the audited implementation does not import or use that package. Installing an unnecessary dependency increases the supply-chain attack surface without supporting declared functionality.

No evidence was found that the currently named packages are malicious or that dependency confusion is actively being exploited. The issue is the unsafe and unnecessarily broad dependency acquisition process.

Attack Path

1. A user follows the documented installation command.
2. pip queries the configured package index and selects whatever package versions currently satisfy the unbounded names.
3. A future compromised, malicious, or incompatible release is downloaded.
4. Package installation hooks or later imports execute the affected dependency code in the user's Python environment.
5. That code operates with the privileges of the user running the installation or Skill.

This path depends on a future upstream or package-index compromise; it is not evidence that such a compromise has already occurred.

Impact Assessment

A compromised dependency could execute arbitrary Python code with the installing user's privileges. Depending on the execution environment, this could expose local files, environment variables, proxy setti ...[truncated 240 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove tqdm from the installation instructions because it is unused.
2. Define reviewed dependency versions in a requirements or lock file.
3. Use hashes for reproducible installation, for example through a generated requirements file consumed with pip install --require-hashes.
4. Keep direct and transitive dependencies updated through a controlled review process.
5. Install dependencies in an isolated virtual environment with the minimum required operating-system privileges.
6. Ensure README.md, SKILL.md, and skill.json declare the same dependency set and constraints.
7. Use a trusted package index and avoid silently falling back to untrusted additional indexes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring describes support for file listing, upload, download, share-link extraction, transfer, and search, which suggests a bounded set of netdisk operations. However, the code also implements directory creation, deletion, renaming, and moving of files/directories, which are materially different write/destructive capabilities not disclosed in that description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTTP headers explicitly set Accept-Language to prefer zh-CN/zh, which enforces a language/locale preference without offering the user a choice. The file also presents all user-facing strings in Chinese, reinforcing a fixed locale behavior rather than an opt-in or configurable setting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes a destructive delete operation that executes immediately based on CLI input, with no confirmation, dry-run mode, scope restriction, or safety interlock. In an agent or automation context, this increases the chance of accidental or prompt-induced deletion of user cloud data, especially because the tool has direct authenticated access to the user's Baidu Netdisk account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list contains broad terms such as "网盘", "转存", and "创建目录" that are generic enough to match many unrelated user requests. In a skill that exposes an exec-capable backend and handles sensitive cloud-storage credentials, unintended activation can cause the wrong toolchain to run against the user's account or filesystem context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README documents a transfer command that writes shared content into the user's Baidu Netdisk, but it does not prominently warn that this is a state-changing action affecting the user's cloud storage. In an agent context, users may interpret the action as a read-only inspection step, increasing the risk of unintended file saves or cluttering their account with untrusted shared content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The top-level docstring says the skill supports upload and download operations. The implemented actions only cover list, search, extract, transfer, mkdir, delete, rename, and move; there is no corresponding upload or download code path, so the documentation actively misstates the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script reads sensitive authentication material (BDUSS and STOKEN) from config.json or environment variables, but there is no nearby user-facing disclosure, warning, or explanatory note about handling these credentials. Access to credentials is safety-relevant and should be made explicit to users of the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.