Baidu Netdisk Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:12 AM UTC
• Version: 1.0.10

Overview

The skill matches its Baidu Netdisk file-management purpose, but it under-discloses credential and upload behavior and uses weak secret handling.

Review before installing. Only use this in an environment where local config files, shell history, terminal logs, and process listings are protected. Prefer OAuth with a strong ENCRYPTION_KEY set, avoid passing tokens or secrets on the command line, rotate any credentials previously configured this way, and confirm you are comfortable granting basic and netdisk read/write scope to this skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/auth.js:21

Finding

OAuth Tokens Are Encrypted with a Public, Hard-Coded Fallback Key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.js:25

Finding

Manual Configuration Exposes Secrets in Process Arguments and Stores Them in Plaintext

Content

View full analysis

', 'API Key') .option('-s, --secret ', 'Secret Key') .option('-t, --token ', 'Access Token') .option('-r, --refresh ', 'Refresh Token') .action(async (options) => { if (options.apikey) config.set('apiKey', options.apikey); if (options.secret) config.set('secretKey', options.secret); if (options.token) config.set('accessToken', options.token); if (options.refresh) config.set('refreshToken', options.refresh); ``` The documented invocation places secrets directly on the command line: ```bash npx baidu-netdisk-skill config -k -s -t ``` The quick-start documentation also recommends passing the access and refresh tokens as command-line arguments: ```bash npx baidu-netdisk-skill config \ -k \ -s \ -t \ -r ``` ### Technical Analysis Credentials supplied through the `config` command are persisted directly with `config.set()` and do not pass through the encryption routine used by the OAuth helper. Consequently, the API secret, access token, and refresh token can be stored as plaintext in the local configuration file. In addition, passing credentials through CLI options exposes them beyond the Node.js process. Depending on the operating system and environment, command-line arguments can be captured through: - Shell history. - Process-listing utilities. - Process telemetry and endpoint monitoring. - Terminal session recording. - CI/CD and automation logs. - Wrapper scripts and command auditing. Even if file permissions restrict the configuratio ...[truncated 1404 chars]

Remediation

View remediation

other

Warning

• Location: skill.json:9

Finding

Security Metadata Incorrectly Denies Credential Collection and Outbound User Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (99)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

2. 填写企业信息
3. 等待审核（1-3 工作日）
4. 手动获取 Code
5. 用 curl 换 Token
6. 命令行配置

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

2. 填写企业信息
3. 等待审核(1-3 工作日)
4. 手动获取 Code
5. 用 curl 换 Token
6. 命令行配置

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The README states that API keys, secret keys, access tokens, and refresh tokens are stored in a local config.json. Even with claims of encryption elsewhere, documenting local storage of all sensitive credentials without clear details on file permissions, encryption-key management, and rotation creates a substantial credential exposure risk on shared or compromised hosts.

Content

Scanner excerpt · README.md (reported line 271)May include surrounding context.

md

默认存储在本地 `config.json`，包含：
- `apiKey` - 百度 API Key
- `secretKey` - 百度 Secret Key
- `accessToken` - Access Token（OAuth 授权后自动保存）
- `refreshToken` - Refresh Token（OAuth 授权后自动保存）

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The file states that Baidu access tokens are stored locally and describes encryption using AES-256-CBC with crypto-js-style key derivation from a user password. This is security-sensitive because local token storage creates credential theft risk if the host or config file is exposed, and the described scheme lacks details about robust KDF parameters, authenticated encryption, secure key management, and token lifecycle protections. In the context of a file-management skill with read/write cloud-storage scope, compromise of the token could allow unauthorized access to user files.

Content

Scanner excerpt · SECURITY.md (reported line 84)May include surrounding context.

1. Token 加密存储

用户的百度 Access Token 使用 AES-256 加密，存储在本地配置文件中。

javascript

// 加密存储，密钥由用户密码派生

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared purpose understates the actual capability surface by omitting credential storage, account info lookup, manual token handling, and cache-related behavior. In agent ecosystems, such mismatches weaken informed consent and can cause operators to grant a skill broader trust than its description warrants.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The documented configuration includes storage and handling of apiKey, secretKey, accessToken, and refreshToken, which are highly sensitive credentials. In the context of an agent skill that also uses unpinned executable package commands, this broad credential handling materially increases the risk of account takeover or long-lived unauthorized access if secrets are logged, exposed, or intercepted.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

|--------|------|------|
| `apiKey` | 百度 API Key（自带 API key 模式使用） | 否 |
| `secretKey` | 百度 Secret Key（自带 API key 模式使用） | 否 |
| `accessToken` | Access Token（OAuth 授权后自动保存） | 否 |
| `refreshToken` | Refresh Token（OAuth 授权后自动保存） | 否 |
| `encryptionKey` | 自定义加密密钥（可选，增强安全性） | 否 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.md (reported line 25)May include surrounding context.

md

- 创建新应用
- 获取 **API Key** 和 **Secret Key**

### 4. 获取 Access Token

方法一：OAuth 授权（推荐）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The curl example places the authorization code, API key, and especially the client secret directly in the URL query string. Query-string secrets are prone to leakage through shell history, terminal logs, browser or proxy logs, process inspection, and copied command history, which is particularly dangerous because the endpoint returns bearer tokens and refresh tokens for cloud storage access.

Content

Scanner excerpt · docs/QUICKSTART.md (reported line 40)May include surrounding context.

访问后获得 code，然后用 code 换 token：

bash

curl "https://openapi.baidu.com/oauth/2.0/token?grant_type=authorization_code&code=你的 CODE&client_id=你的 API_KEY&client_secret=你的 SECRET_KEY&redirect_uri=oob"

返回的 JSON 里有 access_token 和 refresh_token。

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins axios at 1.13.6, and the provided advisory set includes multiple high-severity issues affecting request handling, proxy behavior, and prototype-pollution-related exploitation paths. In a skill that performs OAuth and remote file management over HTTP, a vulnerable HTTP client is especially relevant because it directly mediates authentication, downloads, uploads, and outbound requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: flatted==3.4.1 — 1 advisory(ies): CVE-2026-33228 (Prototype Pollution via parse() in NodeJS flatted)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 81% confidence

Finding

form-data is a runtime dependency commonly used for multipart uploads, which is directly relevant to a file-upload skill. If attacker-controlled filenames or field names are incorporated into multipart requests without proper escaping, CRLF injection could corrupt request structure or enable header injection against upstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest permits axios versions that static analysis maps to a version with numerous advisories, including SSRF- and MITM-related issues. In a Baidu Netdisk skill handling OAuth flows and remote file operations, an HTTP client vulnerability can expose access tokens, redirect requests, bypass proxy protections, or tamper with responses from external services.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 152)May include surrounding context.

md

},
      "accessToken": {
        "type": "string",
        "description": "Access Token（OAuth 授权后自动保存，无需手动配置）",
        "required": false,
        "secret": true
      },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

},
      "accessToken": {
        "type": "string",
        "description": "Access Token（OAuth 授权后自动保存，无需手动配置）",
        "required": false,
        "secret": true
      },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.json (reported line 49)May include surrounding context.

json

},
      "accessToken": {
        "type": "string",
        "description": "Access Token（OAuth 授权后自动保存，无需手动配置）",
        "required": false,
        "secret": true
      },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test-local.sh (reported line 106)May include surrounding context.

sh

},
      "accessToken": {
        "type": "string",
        "description": "Access Token（OAuth 授权后自动保存，无需手动配置）",
        "required": false,
        "secret": true
      },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill stores OAuth access and refresh tokens with AES using a default key derived from a hardcoded constant, and merely reports that the token is encrypted locally. Anyone with access to the code and local config can reproduce the default key and decrypt stored tokens unless the operator overrides ENCRYPTION_KEY, making credential theft feasible on shared or compromised systems.

Content

Scanner excerpt · src/auth.js (reported line 108)May include surrounding context.

js

console.log(chalk.green('\n✅ 百度网盘授权完成！\n'));
      console.log('Token 已加密保存在本地配置文件');
      console.log(`Access Token 有效期：${Math.floor(expires_in / 86400)} 天`);
      console.log('\n你现在可以开始使用百度网盘 Skill 了！\n');
      console.log('常用命令：');
      console.log('  npx baidu-netdisk-skill whoami     # 查看用户信息');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This file handles access and refresh tokens plus client credentials, and it derives a default encryption key from a hardcoded constant if the environment variable is absent. Because that fallback is embedded in code and encryption is reversible, anyone with local config access and source knowledge can potentially recover persisted tokens, leading to account access and long-lived credential compromise.

Content

Scanner excerpt · src/baidu-api.js (reported line 287)May include surrounding context.

js

}

  /**
   * 刷新 Access Token
   */
  async refreshAccessToken() {
    const response = await axios.post(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The CLI accepts API keys, access tokens, and refresh tokens directly as command-line arguments. On many systems, command-line arguments can be exposed through shell history, process listings, audit logs, or job runners, which can leak long-lived credentials and enable unauthorized access to the user's Baidu Netdisk account.

Content

Scanner excerpt · src/index.js (reported line 34)May include surrounding context.

js

.description('配置百度 API 密钥')
  .option('-k, --apikey <key>', 'API Key')
  .option('-s, --secret <secret>', 'Secret Key')
  .option('-t, --token <token>', 'Access Token')
  .option('-r, --refresh <refresh>', 'Refresh Token')
  .action(async (options) => {
    console.log(chalk.blue('🔧 配置百度 API 密钥\n'));

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The tool echoes the first 8 characters of the API key and access token after configuration. Even partial credential disclosure can aid correlation, leak identifying token prefixes into logs/screenshots, and normalize unsafe secret handling in terminal output; combined with the prior CLI-argument issue, this increases accidental exposure risk.

Content

Scanner excerpt · src/index.js (reported line 53)May include surrounding context.

js

if (apiKey && secretKey && accessToken) {
      console.log(chalk.green('✅ 配置完成！'));
      console.log(`API Key: ${apiKey.slice(0, 8)}...`);
      console.log(`Access Token: ${accessToken.slice(0, 8)}...`);
    } else {
      console.log(chalk.yellow('⚠️  配置不完整，请运行：'));
      console.log('npx baidu-netdisk-skill config -k <apikey> -s <secret> -t <token> -r <refresh>');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This line explicitly outputs portions of the access token and refresh token from the local config file. In a local test script for an OAuth-integrated file-management skill, these credentials are highly sensitive because anyone obtaining them may access or refresh access to the user's Baidu Netdisk account; printing even truncated values raises the chance of accidental disclosure through logs or shared environments.

Content

Scanner excerpt · test-local.sh (reported line 54)May include surrounding context.

sh

cat "$CONFIG_FILE" | jq -r '
  "  API Key: " + (if .apiKey then (.apiKey[0:8] + "...") else "未设置" end) +
  "\n  Secret Key: " + (if .secretKey then (.secretKey[0:8] + "...") else "未设置" end) +
  "\n  Access Token: " + (if .accessToken then (.accessToken[0:8] + "...") else "未设置" end) +
  "\n  Refresh Token: " + (if .refreshToken then (.refreshToken[0:8] + "...") else "未设置" end) +
  "\n  Token 过期时间： " + (if .tokenExpires then (.tokenExpires | tostring) else "未设置" end)
' 2>/dev/null || echo "  （无法解析 JSON）"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx baidu-netdisk-auth without a pinned package version. This can fetch the latest package at execution time, creating a supply-chain risk if the package is compromised or a malicious update is published. Because this skill is explicitly intended for credentialed OAuth flows, running an unpinned helper is more dangerous than a generic utility.

Content

No source excerpt is available for this finding.