Security audit

Baidunetdisk Skill

Security checks for vulnerabilities and agentic risk

Overview

This Baidu Netdisk skill is coherent, but it uses full-account cloud credentials and can perform destructive account actions without built-in confirmation safeguards.

Install only if you are comfortable giving the skill full Baidu Netdisk account access. Prefer environment variables or a protected secret store over config.json, use a low-value or test account where possible, narrow invocation triggers, and require explicit user approval before delete, move, rename, transfer, or directory creation actions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:410
Finding: Full-Account Authentication Cookies Stored in a Plaintext Project File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:410-418`; related configuration at `config.json:1-5` **Vulnerability Type**: Plaintext storage of sensitive authentication credentials **Risk Level**: High ### Vulnerable Code ```python # Read configuration config_path = os.path.join(os.path.dirname(__file__), '..', 'config.json') try: with open(config_path, 'r') as f: config = json.load(f) except: config = {} bduss = config.get('bduss', os.getenv('BAIDU_BDUSS', '')) stoken = config.get('stoken', os.getenv('BAIDU_STOKEN', '')) ``` The distributed configuration file provides plaintext fields for these credentials: ```json { "bduss": "", "stoken": "", "default_save_path": "~/Downloads/BaiduNetdisk" } ``` ### Technical Analysis The Skill supports loading the Baidu `BDUSS` and `STOKEN` authentication cookies directly from `config.json`, an ordinary file stored in the project directory. These cookies are documented as granting complete access to the user's Baidu Netdisk account. The implementation does not: - Integrate with an operating-system credential store or another protected secret-management facility. - Validate that `config.json` has restrictive file permissions. - Warn or refuse to operate when the credential file is readable by other local users. - Include evidence of source-control exclusion for the populated configuration file. Consequently, credentials can be exposed through accidental source-control commits, project archives, backups, permissive filesystem permissions, or other local processes with access to the project directory. The credentials are subsequently sent as cookies only to fixed HTTPS endpoints under `pan.baidu.com`. That network transmission is necessary for the declared authenticated Netdisk functionality and does not, by itself, indicate credential exfiltration. The vulnerability is the supported plaintext-at-rest workflow. ### Attack Path 1. A user places valid `BDUSS` and `STOKEN ...[truncated 1011 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove file-based credential storage from the default configuration workflow. 2. Prefer an operating-system credential store or a dedicated secret-management service. 3. If environment variables remain supported, make them the documented fallback for development rather than encouraging populated project files. 4. Distribute a credential-free `config.example.json` instead of a credential-bearing `config.json`. 5. Add `config.json` and other local secret files to `.gitignore`. 6. If file-based storage must remain available: - Require owner-only permissions, such as mode `0600` on Unix-like systems. - Check permissions before reading the file and reject insecure configurations. - Avoid placing the file inside the source tree. 7. Document credential rotation and immediate session revocation procedures. 8. Use a dedicated test account with minimal valuable data where possible. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:270
Finding: Destructive Cloud-File Deletion Has No Explicit Confirmation Safeguard<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:270-295`; command dispatch at `scripts/main.py:466-469` **Vulnerability Type**: Unprotected destructive operation **Risk Level**: Medium ### Vulnerable Code ```python def delete_file(self, path: str): """Delete a file or directory. Uses the filemanager API and requires bdstoken. """ try: # Obtain bdstoken bdstoken = self._get_bdstoken() if not bdstoken: return {'success': False, 'error': 'Unable to obtain bdstoken; check login status'} url = "https://pan.baidu.com/api/filemanager" params = { 'opera': 'delete', 'async': '2', 'onnest': 'fail', 'channel': 'chunlei', 'web': 1, 'app_id': 250528, 'bdstoken': bdstoken, 'clienttype': 0 } data = { 'filelist': json.dumps([path]) } resp = self.session.post( url, params=params, data=data, cookies=self._get_cookies() ) result = resp.json() ``` The action dispatcher invokes deletion immediately: ```python elif action == 'delete': result = api.delete_file( path=params.get('path', '') ) ``` ### Technical Analysis The `delete` action performs an authenticated file-manager request immediately after receiving a path. There is no separate confirmation token, interactive approval, dry-run stage, allowlist, or policy check for destructive operations. The dispatcher also defaults a missing path to an empty string and passes it to the API without path normalization or explicit rejection. Although the remote API may reject some invalid paths, relying on server-side behavior is not a sufficient local safety boundary. This is particularly risky in an AI Agent context. An ambiguous user request, incorrectly extracted path, or malicious instruction in untrusted content could ...[truncated 1304 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit confirmation through a separate argument, such as `confirm_delete=<one-time-token>`. 2. For Agent use, require an independent user-approval step immediately before deletion. 3. Normalize and validate paths before issuing a request. 4. Reject empty paths, the root path, malformed paths, and other broad or ambiguous targets. 5. Display the exact normalized target and require confirmation of that same target. 6. Implement a dry-run or metadata lookup that shows whether the target is a file or directory and estimates the affected scope. 7. Prefer recycle-bin or soft-delete behavior where the API supports it. 8. Record a minimal audit event containing the action, target, and timestamp, while excluding credentials and authentication tokens. 9. Consider disabling destructive actions by default and requiring an explicit configuration option to enable them. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The module description advertises only benign capabilities like listing, upload/download, share extraction, transfer, and search, but the implementation also supports destructive operations including delete, move, and rename. This mismatch can mislead users or integrators about the true risk profile of the skill, increasing the chance that destructive actions are invoked without informed consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The delete operation directly performs a remote file deletion using authenticated Baidu Netdisk APIs with no confirmation prompt, dry-run mode, allowlist, or guardrails. In an agentic context, a mistaken instruction, prompt injection, or parameter confusion could immediately destroy user data with little opportunity to recover.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill loads BDUSS and STOKEN credentials from config or environment and then uses them to authenticate outbound requests, but there is no explicit disclosure to the user at runtime that sensitive account tokens are being accessed and transmitted. In agent environments, this can violate user expectations and create risk if secrets are supplied implicitly or reused in unintended contexts.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad terms such as "网盘", "转存", and "创建目录" that can appear in ordinary user requests unrelated to this specific skill. Because the skill has access to an exec-capable tool and manages cloud files using sensitive session credentials, accidental invocation could cause unintended file operations or expose the user to destructive actions in the wrong context.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The skill documentation and all invocation examples are exclusively written in Chinese, including the example agent messages users are expected to send. Under the policy for natural-language constraints, this can be a locale/language restriction because the file does not indicate that other languages are supported or provide an opt-in choice.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The file presents all instructions, warnings, and usage examples only in Chinese, which effectively forces a specific language without indicating user opt-in or providing an alternative. Under the stated policy, language-specific behavior should either offer a choice or clearly justify the locale constraint.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The Accept-Language header is fixed to prefer zh-CN/zh, which enforces a specific locale choice in network interactions without offering the user an option to select language or locale. This is a natural-language policy concern because the implementation bakes in a language preference rather than making it configurable or clearly justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 75% confidence
Finding: The natural-language description and multiple trigger phrases are Chinese-only, with no indication that users may interact in another language or that the skill is intentionally restricted to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue unless the constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.