pikpak-batch-backup

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 3:49 PM UTC
• Version: 1.0.7

Overview

This skill is a disclosed PikPak-to-local backup helper that runs a local CLI and writes local backup files, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you are comfortable using PikPak through a local CLI and can keep PIKPAK_BIN, PATH, Python, and the backup directory under your own control. Use the dry-run first, choose a new empty destination directory, and treat the manifest as private because it records file names and paths. The referral code is disclosed and optional.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Direct flow: os.environ.get (credential/environment) → subprocess.run (code execution)

High

• Category: Data Flow
• Confidence: 89% confidence

Finding

The script executes whatever binary path is supplied via PIKPAK_BIN, and if that is unset it relies on PATH resolution for 'pikpak'. In untrusted CI, multi-user systems, or any environment where callers can influence environment variables or PATH, an attacker can cause arbitrary code execution by pointing to a malicious executable.

Content

Scanner excerpt · scripts/batch_backup.py (reported line 106)May include surrounding context.

python

def pikpak(*args: str, timeout: int = 3600):
    try:
        proc = subprocess.run([os.environ.get("PIKPAK_BIN", "pikpak"), *args],
                              capture_output=True, text=True, timeout=timeout)
        if proc.returncode:
            return proc.returncode, "", f"cli_failed (exit_code={proc.returncode})"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language content is fully in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language documentation and runtime messages in Chinese, including the top-level docstring and later error/output strings. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_backup.py (reported line 106)May include surrounding context.

python

def pikpak(*args: str, timeout: int = 3600):
    try:
        proc = subprocess.run([os.environ.get("PIKPAK_BIN", "pikpak"), *args],
                              capture_output=True, text=True, timeout=timeout)
        if proc.returncode:
            return proc.returncode, "", f"cli_failed (exit_code={proc.returncode})"

Static analysis

No suspicious patterns detected.