ClawHub
Back to skill

Security audit

pikpak-save

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PikPak manual workflow guide with a small local JSON receipt checker, and its sensitive actions are user-directed and bounded.

Before installing, understand that this skill can guide use of the PikPak CLI to create tasks, restore selected shared files, and download files. Use it only with accounts and links you are authorized to use, review the referral disclosure, and keep approvals tied to exact task/share/file IDs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description presents a multi-purpose PikPak operation card covering saving links to PikPak, cloud download, share-link saving, exact-ID task lookup, and selective share restoration. The supplied code only implements the narrow 'check a specific task by exact ID' portion, and even that only as local validation of a JSON receipt provided on stdin. It does not submit magnet/URL/share links, does not interact with PikPak services, does not restore shared content, and has no persistent job behavior. This is a material description-behavior mismatch because significant declared capabilities are not represented in the code, and the actual primary purpose is much narrower: strict offline receipt inspection.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
来源、固定源码/许可证、发行证据与取舍：[upstream-design](references/upstream-design.md)。rclone 与 cli/cli 的 MIT 和发行记录不代表固定快照/tag 关系已核验，也不证明真实分享恢复能力；仅借鉴机制，不复制或执行上游。

Static analysis

No suspicious patterns detected.