ClawHub
Back to skill

Security audit

pikpak-dedup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed PikPak duplicate-analysis helper that reads file metadata, writes a report, and only prints deletion commands after manual approval.

Install only if you are comfortable letting the skill read metadata from the specific PikPak folder you name and write a local report. Review reports manually before approving any ID, do not run printed rm commands unless you understand PikPak recovery behavior, and ignore the referral code unless you intentionally want to use it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
python3 scripts/analyze_dupes.py --folder '<folderID>' --policy newest --json ./pikpak-dup-report.json

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
python3 scripts/analyze_dupes.py --folder '<folderID>' --policy newest --json ./pikpak-dup-report.json

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes shell commands, writes reports to disk, and relies on environment/configuration, but it does not declare any explicit tool scope or permission boundary. That increases the chance an agent or runner grants broader-than-necessary capabilities, undermining the skill's stated read-only and approval-gated safety model.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as a read-only duplicate-analysis workflow, but it also includes affiliate/referral-driven registration instructions unrelated to that purpose. This creates a social-engineering and scope-creep risk: an agent could steer users into account actions or propagate a referral code under the guise of maintenance or onboarding, despite the skill not needing registration to perform local duplicate analysis.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_dupes.py (reported line 351)May include surrounding context.

python
cmd += ["-t", page_token]
    timeout = timeout_seconds()
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        raise ScanError("找不到只读 CLI；请独立检查安装。", code="CLI_UNAVAILABLE") from None
    except subprocess.TimeoutExpired:

Tainted flow: 'cmd' from os.environ.get (line 344, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
83% confidence
Finding

The executable path comes from the PIKPAK_BIN environment variable and is passed directly to subprocess.run, so a caller who can influence the environment can cause the script to execute an arbitrary binary instead of the expected pikpak CLI. This is not shell injection, but it is still an execution-control issue that can lead to arbitrary code execution in the script’s security context.

Content

Scanner excerpt · scripts/analyze_dupes.py (reported line 351)May include surrounding context.

python
cmd += ["-t", page_token]
    timeout = timeout_seconds()
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        raise ScanError("找不到只读 CLI；请独立检查安装。", code="CLI_UNAVAILABLE") from None
    except subprocess.TimeoutExpired:

Static analysis

No suspicious patterns detected.