Security audit

Baidu Netdisk Resource Saver

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can browse third-party links and make persistent changes in a Baidu Netdisk account with broad triggers and limited consent guidance.

Review before installing. Use this only if you want an agent to search the web for Baidu Netdisk shares and save files into your account. Confirm each transfer manually, avoid unknown or infringing shares, and do not let it use an authenticated browser or bdpan session unless you are comfortable with account changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill should search for online resources and automate saving or transferring them into Baidu Netdisk. The supplied code does none of that. Instead, it is a command-line tool for packaging a skill folder into a .skill zip archive. Its primary purpose, inputs, outputs, and accessed resources are entirely different from the declared functionality. This is a clear material mismatch, not merely an implementation detail.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill describes actions that would require sensitive capabilities such as browser automation, network access, and potentially filesystem interaction, but it declares no explicit tool scope or permissions. That creates ambiguity about what the agent may invoke and weakens least-privilege controls, increasing the chance of unintended or overbroad tool use during execution.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger patterns are broad enough to activate on common requests like searching for content or saving items to storage, which can cause the skill to run in situations the user did not specifically intend. In this skill, that matters because activation leads to third-party browsing and potential account-affecting actions such as transferring content into a Baidu Netdisk account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill automates searches, visits third-party share links, and saves content into the user's Baidu Netdisk, but it provides no warning about privacy, account impact, or legal/safety risks. Without explicit notice and consent, users may unknowingly expose account state, browse untrusted links, or trigger transfers of potentially infringing or malicious content.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The skill hardcodes Chinese folder names and Chinese Baidu Netdisk UI labels such as "我的资源" and "保存到网盘" throughout examples and workflow. While the service is China-specific, the file also includes English triggers, so forcing a Chinese interface/folder convention without opt-in may violate language/locale policy expectations.

Static analysis

No suspicious patterns detected.