baidupcs-go - 百度网盘命令行工具

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:41 AM UTC
• Version: 1.0.0

Overview

This Baidu Netdisk skill is mostly purpose-aligned, but it relies on an unverified third-party executable path and exposes sensitive login and destructive file-management commands with limited safeguards.

Review this before installing. Use only a BaiduPCS-Go executable from a source you trust, preferably with independently verified hashes or by building from source. Treat BDUSS, STOKEN, and full cookies like passwords, avoid placing them in shell history or logs, and require explicit confirmation before delete, purge, overwrite, unshare, or broad wildcard operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: BaiduPCS-Go.md:327
• Finding: Unverified Remote Executable Distribution<下载使用. 密码:4pix ``` The documentation states that precompiled binaries for common platforms can be downloaded directly from the linked third-party file-sharing service, using the supplied password. ### Technical Analysis The installation instructions direct users to obtain and run a precompiled `BaiduPCS-Go` executable from a third-party file-sharing URL. The project does not provide a pinned artifact version, cryptographic checksum, digital signature, signed release manifest, or reproducible-build verification procedure. Consequently, the binary executed by a user is not the same content that was available for static review. The remote artifact can be replaced or modified without changing the audited Skill package. Compromise of the hosting account, distribution service, or download link could therefore introduce arbitrary executable code after the audit. This risk is particularly significant because the executable is intended to process high-value Baidu authentication material, including BDUSS, STOKEN, and complete session cookies. It also receives paths to local files during upload operations and writes files to the local system during downloads. ### Attack Path 1. A user installs or invokes the Skill and discovers that an external `BaiduPCS-Go` executable is required. 2. The user follows the documentation and downloads the password-protected binary from the third-party file-sharing URL. 3. An attacker who has compromised the hosting account or replaced the remote artifact supplies a modified executable through the same URL. 4. The user runs the modified executable under their operating-system account. 5. The user provides Baidu session credentials or invokes oper ...[truncated 1103 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Distribute binaries through an official, access-controlled release repository rather than a mutable third-party file-sharing link. 2. Pin documentation to an immutable release version and artifact URL. 3. Publish SHA-256 or stronger cryptographic hashes for every supported platform and architecture. 4. Sign release artifacts and manifests with a documented code-signing or OpenPGP key, and require signature verification before execution. 5. Publish the corresponding source revision and reproducible build instructions so users can verify binary provenance. 6. Add explicit installation steps that fail closed when checksum or signature verification does not succeed. 7. Protect release credentials with multi-factor authentication and limit artifact-publishing permissions. 8. Prefer platform package managers that support signed metadata and integrity verification. 9. Avoid passing authentication secrets on command lines. Use protected credential files, secure interactive input, or operating-system credential stores to reduce exposure through shell history and process inspection. 10. Treat existing artifacts as untrusted until their provenance and integrity have been independently verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-p value        指定下载线程数 (default: 0)
  -l value        指定同时进行下载文件的数量 (default: 0)
  --retry value   下载失败最大重试次数 (default: 3)
  --nocheck       下载文件完成后不校验文件

```

• Confidence: 89% confidence
• Finding: The documented --nocheck option disables post-download integrity verification, which can cause users or downstream automation to trust corrupted, incomplete, or tampered files. In a cloud-download client, normalizing integrity-bypass flags without strong warnings reduces defense against transfer errors and malicious content substitution.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
# 删除 /我的资源/1.mp4
BaiduPCS-Go rm /我的资源/1.mp4

# 删除 /我的资源/1.mp4 和 /我的资源/2.mp4
BaiduPCS-Go rm /我的资源/1.mp4 /我的资源/2.mp4

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
# 删除 /我的资源/1.mp4
BaiduPCS-Go rm /我的资源/1.mp4

# 删除 /我的资源/1.mp4 和 /我的资源/2.mp4
BaiduPCS-Go rm /我的资源/1.mp4 /我的资源/2.mp4

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

BaiduPCS-Go rm /我的资源/1.mp4 /我的资源/2.mp4

# 删除 /我的资源 内的所有文件和目录, 但不删除该目录
BaiduPCS-Go rm /我的资源/*

# 删除 /我的资源 整个目录 !!
BaiduPCS-Go rm /我的资源

• Confidence: 85% confidence
• Finding: The example uses a wildcard deletion pattern that can remove all contents of a directory, creating a substantially higher risk of accidental mass deletion, especially in an interactive shell-like environment. Although not inherently malicious, documenting bulk-destructive syntax without a prominent consolidated safety warning increases the chance of operator error and data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

BaiduPCS-Go rm /我的资源/*

# 删除 /我的资源 整个目录 !!
BaiduPCS-Go rm /我的资源
```

## 拷贝文件/目录

• Confidence: 87% confidence
• Finding: The example documents deletion of an entire directory, explicitly emphasized with exclamation marks, which can cause large-scale data loss if copied blindly. In a shell-like client handling user cloud storage, such commands are high-risk and should be surrounded by stronger safety guidance because path mistakes can destroy significant amounts of data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to obtain and pass highly sensitive Baidu session credentials (BDUSS, STOKEN, full Cookies) directly on the command line, including a full cookie example. Command-line arguments are commonly exposed via shell history, process listings, logs, screenshots, and copied transcripts, so this materially increases the risk of account takeover if reused or leaked.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The file documents `offlinedl delete -all` and notes that the program will not perform a second confirmation, and similarly documents recycle-bin purge operations elsewhere. Although '谨慎操作' is present inline, the skill description lacks a stronger user-facing warning section highlighting that these commands can bulk-delete task records or recycle-bin contents without confirmation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly advertises destructive operations such as deleting files, moving content, canceling shares, and permanently deleting recycle-bin items, but it does not warn users about irreversible actions, confirmation requirements, or recovery limitations. In an agent skill context, this omission increases the chance of unsafe automation or accidental execution that could cause data loss or unintended exposure changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The login command explicitly accepts sensitive authentication material such as BDUSS, STOKEN, and cookies directly on the command line. Supplying secrets via CLI arguments is dangerous because they can be exposed through shell history, process listings, logs, or telemetry, and the command description provides no warning or safer alternative.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The delete command enables removal of one or more files or directories but includes no warning, confirmation behavior, or indication of reversibility. In an agent skill context, this increases the chance of accidental or unauthorized destructive actions, especially if invoked programmatically or with broad path arguments.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All headings, instructions, prompts, and examples are presented in Chinese, and the documented interaction flow presumes Chinese-speaking users. Under the stated policy, forcing a specific language without user opt-in or an explicit justified locale scope is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The natural-language description "百度网盘命令行客户端技能" forces a specific language presentation in the manifest without offering an alternative language or documenting that the skill is intended only for a Chinese-language audience. Under the policy for natural-language violations, this can be considered a language/locale constraint lacking user opt-in or explicit justification.

Static analysis

No suspicious patterns detected.