pikpak-webdav-guide

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 3:27 PM UTC
• Version: 1.0.5

Overview

This skill is a disclosed PikPak WebDAV setup guide with an optional local metadata check, and I found no hidden persistence, exfiltration, or destructive behavior.

Install only if you want a PikPak WebDAV configuration guide. Keep WebDAV credentials inside trusted local clients, do not paste passwords or tokens into chat, and run scripts/webdav_check.py against a real account only after confirming the account is yours and the local CLI/PATH environment is trusted. Review the disclosed referral code before using any registration command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description lists triggers including "connect media player," which is broad and not uniquely tied to PikPak WebDAV setup. This overlaps with common user requests about many media tools and lacks negative examples or tighter scope constraints, increasing the chance of accidental activation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/webdav_check.py (reported line 35)May include surrounding context.

python

def pikpak_json(*args: str, timeout: int = 60):
    bin_path = os.environ.get("PIKPAK_BIN", "pikpak")
    try:
        proc = subprocess.run([bin_path, *args, "-F", "json"],
                              capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        return None, f"找不到 pikpak 命令（官方安装页：https://mypikpak.com/cli）"

Tainted flow: 'bin_path' from os.environ.get (line 33, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 78% confidence

Finding

The executable path is taken directly from the PIKPAK_BIN environment variable and then executed. An attacker who can influence the environment can cause this script to run an arbitrary program instead of the official PikPak CLI, which is especially relevant in agent, automation, or shared-host contexts where environment variables may be attacker-controlled or inherited implicitly.

Content

Scanner excerpt · scripts/webdav_check.py (reported line 35)May include surrounding context.

python

def pikpak_json(*args: str, timeout: int = 60):
    bin_path = os.environ.get("PIKPAK_BIN", "pikpak")
    try:
        proc = subprocess.run([bin_path, *args, "-F", "json"],
                              capture_output=True, text=True, timeout=timeout)
    except FileNotFoundError:
        return None, f"找不到 pikpak 命令（官方安装页：https://mypikpak.com/cli）"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The document directs policy/reference use to Chinese-language official pages (zh-CN) as the authoritative source, but does not mention any user language preference, alternative locale, or a justification that this skill is region-specific. This can be a natural-language locale policy issue because it imposes a specific locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.