T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:410- Finding
Full-Account Authentication Cookies Stored in a Plaintext Project File
- Content
View full analysis
- Remediation
View remediation
Security audit
Baidunetdisk Skill
Security checks for vulnerabilities and agentic risk
Overview
This Baidu Netdisk skill is coherent, but it uses full-account cloud credentials and can perform destructive account actions without built-in confirmation safeguards.
Install only if you are comfortable giving the skill full Baidu Netdisk account access. Prefer environment variables or a protected secret store over config.json, use a low-value or test account where possible, narrow invocation triggers, and require explicit user approval before delete, move, rename, transfer, or directory creation actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:270- Finding
Destructive Cloud-File Deletion Has No Explicit Confirmation Safeguard
- Content
View full analysis
- Remediation
View remediation
`. 2. For Agent use, require an independent user-approval step immediately before deletion. 3. Normalize and validate paths before issuing a request. 4. Reject empty paths, the root path, malformed paths, and other broad or ambiguous targets. 5. Display the exact normalized target and require confirmation of that same target. 6. Implement a dry-run or metadata lookup that shows whether the target is a file or directory and estimates the affected scope. 7. Prefer recycle-bin or soft-delete behavior where the API supports it. 8. Record a minimal audit event containing the action, target, and timestamp, while excluding credentials and authentication tokens. 9. Consider disabling destructive actions by default and requiring an explicit configuration option to enable them. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module description advertises only benign capabilities like listing, upload/download, share extraction, transfer, and search, but the implementation also supports destructive operations including delete, move, and rename. This mismatch can mislead users or integrators about the true risk profile of the skill, increasing the chance that destructive actions are invoked without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The delete operation directly performs a remote file deletion using authenticated Baidu Netdisk APIs with no confirmation prompt, dry-run mode, allowlist, or guardrails. In an agentic context, a mistaken instruction, prompt injection, or parameter confusion could immediately destroy user data with little opportunity to recover.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill loads BDUSS and STOKEN credentials from config or environment and then uses them to authenticate outbound requests, but there is no explicit disclosure to the user at runtime that sensitive account tokens are being accessed and transmitted. In agent environments, this can violate user expectations and create risk if secrets are supplied implicitly or reused in unintended contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes broad terms such as "网盘", "转存", and "创建目录" that can appear in ordinary user requests unrelated to this specific skill. Because the skill has access to an exec-capable tool and manages cloud files using sensitive session credentials, accidental invocation could cause unintended file operations or expose the user to destructive actions in the wrong context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documentation and all invocation examples are exclusively written in Chinese, including the example agent messages users are expected to send. Under the policy for natural-language constraints, this can be a locale/language restriction because the file does not indicate that other languages are supported or provide an opt-in choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents all instructions, warnings, and usage examples only in Chinese, which effectively forces a specific language without indicating user opt-in or providing an alternative. Under the stated policy, language-specific behavior should either offer a choice or clearly justify the locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Accept-Language header is fixed to prefer zh-CN/zh, which enforces a specific locale choice in network interactions without offering the user an option to select language or locale. This is a natural-language policy concern because the implementation bakes in a language preference rather than making it configurable or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The natural-language description and multiple trigger phrases are Chinese-only, with no indication that users may interact in another language or that the skill is intentionally restricted to a Chinese-language audience. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue unless the constraint is clearly documented and justified.
- Content
Static analysis
No suspicious patterns detected.