ClawHub
Back to skill

Security audit

Baidu Disk Manager

Security checks for vulnerabilities and agentic risk

Overview

This Baidu Netdisk manager is purpose-aligned, but it depends on an unbundled relative CLI and gives sensitive credential and file-transfer instructions without enough safeguards.

Install only if you trust the go-bdisk executable that will be used. Before running any upload, download, move, rename, copy, or delete, verify the exact local and remote paths. Avoid putting real secrets directly in command arguments; prefer a safer login method if the CLI supports one, and rotate credentials if they may have been saved in shell history or logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:27
Finding

Application Secret Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
./scripts/go-bdisk login --app-key YOUR_APP_KEY --secret-key YOUR_SECRET_KEY

Technical Analysis

The documented login procedure instructs users to supply the Baidu application secret directly as a command-line argument. After the placeholder is replaced with a real credential, that secret may become visible through:

  • Shell history files
  • Process-listing and monitoring utilities
  • Terminal session recording
  • Command audit logs
  • Automation and diagnostic logs that capture complete command lines

Although the instruction says that users should execute the login command themselves, this does not mitigate exposure caused by the command's credential transport mechanism. The referenced ./scripts/go-bdisk executable was not included in the supplied project, so its internal credential storage and handling could not be evaluated.

Attack Path

  1. A user replaces YOUR_SECRET_KEY with a valid Baidu application secret.
  2. The user executes the documented login command.
  3. The shell, operating system, or a monitoring facility records the complete command line.
  4. An unauthorized local user, administrator, monitoring agent, or log reader retrieves the recorded argument.
  5. The exposed secret may be reused wherever the corresponding Baidu application credential is accepted.

This path requires access to process information, command history, or captured logs; the audited files do not establish remote exploitation.

Impact Assessment

Successful exploitation discloses the configured Baidu application secret. An attacker could potentially impersonate the corresponding application or abuse API access associated with that credential, subject to Baidu's authentication controls and any additional credentials or authorization required.

The exact accessible ...[truncated 200 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not accept application secrets through command-line arguments.
  • Prefer an interactive hidden prompt that reads the secret without echoing it.
  • Alternatively, read the secret from standard input or a credential file restricted to the owning user.
  • If environment variables must be supported, document their exposure risks and ensure they are not logged or inherited unnecessarily.
  • Store resulting credentials or tokens using an operating-system credential store where available.
  • Redact secrets from errors, diagnostics, telemetry, and structured output.
  • Update the documentation with a safe pattern, such as:
bash
read -s -p "Baidu application secret: " BAIDU_SECRET
printf '%s' "$BAIDU_SECRET" | ./scripts/go-bdisk login \
  --app-key "$BAIDU_APP_KEY" \
  --secret-key-stdin
unset BAIDU_SECRET
  • Implement and verify the corresponding --secret-key-stdin or secure interactive-input behavior in go-bdisk.
  • Advise users who followed the previous procedure to remove affected shell-history entries and rotate any credential that may have been recorded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The skill passes user-influenced file paths directly into a destructive CLI operation (rm) without documenting path validation, normalization, or restriction. If an agent constructs parameters from user input naively, an attacker could target unintended cloud paths or exploit edge cases in the underlying tool's argument handling, leading to unauthorized deletion of remote data.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

确认后执行：

bash
./scripts/go-bdisk rm /要删除的文件.txt -j

上传文件

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

This usage example encourages executing a destructive delete command from a user request with no safeguards beyond conversational confirmation. In the skill context, where file paths may be derived from natural language, insufficient parameter validation can cause deletion of the wrong remote object or broaden the impact of maliciously crafted input.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md
7. 用户提问：「删除旧文件.txt」
   - 向用户确认变更信息（注意警告此操作不可恢复）
   - 等待用户回复「确认」「ok」或「行」
   - 确认后执行：`./scripts/go-bdisk rm /旧文件.txt -j`

### 登录操作（用户明确要求才执行）

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The confirmation flow only accepts a narrow set of replies ("确认", "ok", or "行"), which is brittle in multilingual or ambiguous conversational contexts. This can lead to unsafe execution if the agent over-interprets a response, or to inconsistent safety behavior when users express consent in other ways.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill allows upload and download operations without requiring an explicit warning or confirmation about local file access and privacy implications. In an agent setting, this can cause unintended exfiltration of local files to Baidu Netdisk or unintended writes/downloads to the local filesystem when the user did not fully appreciate that a local path would be accessed.

Content

No source excerpt is available for this finding.