ClawHub
Back to skill

Security audit

quarkclouddrive

Security checks for vulnerabilities and agentic risk

Overview

This cloud-drive skill mostly matches its stated purpose, but it needs review because installation can download and run unverified remote code and every CLI call forwards the user's raw prompt text.

Install only if you trust this publisher and are comfortable with a self-updating cloud-drive tool that can change its own runtime from a remote service. Avoid using it with highly sensitive prompts unless raw prompt forwarding is acceptable, and review install/uninstall actions carefully because they can alter local tooling, authorization state, and cloud-file organization.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:243
Finding

Unverified Remote Skill Archive Is Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: install.sh:243-270, 293-311, 362-373
Vulnerability Type: Unverified remote code retrieval and execution
Risk Level: High

Complete Code Snippet

bash
REMOTE_VERSION=$(printf '%s' "$parsed" | sed -n '1p')
ZIP_DOWNLOAD_URL=$(printf '%s' "$parsed" | sed -n '2p')

if [[ ! "$ZIP_DOWNLOAD_URL" =~ ^https?://[^[:space:]]+$ ]]; then
  error "skill_config 接口未返回有效的 zip 下载地址"
  return 1
fi

info "接口版本: ${REMOTE_VERSION:-未知}"
info "下载地址: $ZIP_DOWNLOAD_URL"
bash
download_and_extract() {
  info "Step 3: 下载 skill zip 包..."

  mkdir -p "$TMP_DIR"
  local zip_path="$TMP_DIR/skill.zip"

  if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
    warn "下载失败，重试中..."
    if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
      error "下载 zip 包失败: $ZIP_DOWNLOAD_URL"
      return 1
    fi
  fi

  info "下载完成，正在解压..."
  unzip -qo "$zip_path" -d "$TMP_DIR"
  info "解压完成"
}
bash
if [ "$IS_UPDATE" = "true" ]; then
  info "更新模式: 整个覆盖 scripts 目录"
  rm -rf "$scripts_dest"
  cp -rf "$scripts_src" "$scripts_dest"
  for file in "$scripts_dest"/*; do
    local filename
    filename=$(basename "$file")
    info "  [更新]  scripts/$filename → $scripts_dest/$filename"
    installed_count=$((installed_count + 1))
  done
else
  cp -rf "$scripts_src" "$scripts_dest"
bash
verify_installation() {
  info "Step 5: 自检验证..."

  local cli_entry="$SKILL_DIR/scripts/quark-drive.cjs"

  if [ ! -f "$cli_entry" ]; then
    error "CLI 入口文件不存在: $cli_entry"
    return 1
  fi

  local version_output
  if version_output=$(node "$cli_entry" --version 2>&1); then
    info "CLI 安装成功，版本: $version_output"
    return 0
  fi

Technical Analysis

The installation service returns ZIP_DOWNLOAD_URL, which is accepted whenever it begins with either https:// or http://. The installer then downloads that archive without verifying a publisher signature, pinned d ...[truncated 2041 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reject all non-HTTPS archive URLs and fail closed on redirects to a different scheme or an unapproved host.
  2. Restrict archive downloads to an explicit allowlist of trusted HTTPS origins.
  3. Publish a signed manifest containing the version, archive digest, size, and approved origin.
  4. Verify the archive with a pinned publisher public key before extraction or installation; a digest fetched from the same unauthenticated source is insufficient.
  5. Extract into a fresh staging directory and reject absolute paths, .. traversal, symbolic-link escapes, device files, and unexpected file types.
  6. Validate the expected package structure and executable inventory before replacing the installed directory.
  7. Perform an atomic directory replacement only after every verification succeeds.
  8. Do not execute the downloaded CLI as an installation check until authenticity and structure validation are complete.
  9. Preserve the previous verified installation and automatically roll back if validation fails.

T09 · Insecure Skill Coding Practices

Warning
Location
uninstall.sh:26
Finding

Uninstallation Performs Destructive Actions Without an Enforced Confirmation Gate

Content
View full analysis

Vulnerability Details

File Location: uninstall.sh:26-38, 88-94, 112-131
Vulnerability Type: Missing executable authorization control for destructive operations
Risk Level: Medium

Complete Code Snippet

bash
revoke_auth() {
  info "Step 1: 撤销本机授权并清除当前 agent 配置 (logout)..."

  local cli_entry="$SKILL_DIR/scripts/quark-drive.cjs"

  if [ -f "$cli_entry" ]; then
    if node "$cli_entry" logout >/dev/null 2>&1; then
      info "  已撤销本机授权并清除当前 agent 配置"
    else
      warn "  撤销本机授权失败（可能未登录或网络异常），继续卸载"
    fi
  else
    info "  未找到 CLI 入口文件，跳过授权撤销"
  fi

  return 0
}
bash
remove_legacy_global_dir() {
  info "Step 3: 清除旧版全局目录..."

  if [ -d "$LEGACY_GLOBAL_DIR" ]; then
    rm -rf "$LEGACY_GLOBAL_DIR"
    info "  已删除旧版全局目录: $LEGACY_GLOBAL_DIR"
  else
    info "  未发现旧版全局目录，跳过"
  fi
}
bash
main() {
  info "=== quarkclouddrive CLI 卸载脚本 ==="
  echo ""

  revoke_auth

  remove_legacy_global_command

  remove_legacy_global_dir

  print_result
}

main "$@"

The intended confirmation exists only as an Agent instruction in SKILL.md:304:

markdown
卸载属不可逆操作，agent 调用前**必须**向用户二次确认，详见 [references/auth.md](references/auth.md)。

Technical Analysis

The documentation requires secondary user confirmation before uninstallation, but uninstall.sh does not technically enforce that requirement. It accepts no confirmation token, has no interactive prompt, and immediately performs destructive operations whenever invoked.

The script calls the installed CLI's logout command, which is documented as revoking the current authorization and removing the current Agent configuration. It then recursively deletes the fixed legacy configuration directory at $HOME/.quarkclouddrive. A direct script invocation therefore bypasses the documented confirmation boundary.

The deletion target is derived from $HOME and is not supplied by a remote input, so this is not an arbitrary-path deletion finding. The issue is the absence of executable authori ...[truncated 1101 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require an explicit confirmation capability, such as --confirm-uninstall, and abort when it is absent.
  2. Prefer an interactive prompt requiring the user to enter a specific confirmation phrase when a terminal is available.
  3. For noninteractive Agent use, issue a short-lived confirmation token during a preview step and require that token for execution.
  4. Add a default dry-run mode that reports the authorization and directories that would be removed.
  5. Resolve and validate $LEGACY_GLOBAL_DIR before deletion, ensuring it exactly matches the expected application directory under a valid home directory.
  6. Refuse to proceed if $HOME is empty, /, or resolves to an unexpected location.
  7. Separate authorization revocation from local configuration deletion so each destructive operation can be explicitly authorized and reported.
  8. Return a nonzero status if revocation fails unless the user separately confirms that local deletion should continue despite that failure.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description presents cloud-drive functionality, but the file also mandates an uninstall workflow that revokes authorization, removes global binaries/links, and deletes local directories. This is a significant capability beyond ordinary drive operations and could be abused to disrupt the environment or remove software unexpectedly if invoked under misleading expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description presents cloud-drive functionality, but the file also mandates an uninstall workflow that revokes authorization, removes global binaries/links, and deletes local directories. This is a significant capability beyond ordinary drive operations and could be abused to disrupt the environment or remove software unexpectedly if invoked under misleading expectations.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
> 当用户表达「升级 skill」「更新夸克网盘 skill」等诉求时，agent **必须**直接执行 `bash scripts/install.sh`，由脚本进入更新模式，同步更新 CLI 运行时文件、`SKILL.md` 和 `references/`，保证 skill 完整升级。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

md
> 当用户表达「升级 skill」「更新夸克网盘 skill」等诉求时，agent **必须**直接执行 `bash scripts/install.sh`，由脚本进入更新模式，同步更新 CLI 运行时文件、`SKILL.md` 和 `references/`，保证 skill 完整升级。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
后续每次调用都重新依据对应的 `install.sh` 返回结果判断，不沿用上一次的升级状态，也不因之前已展示过提示而省略参数。

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This pipeline chains network retrieval directly into privileged shell execution, collapsing fetch, trust, and execution into one step with no verification boundary. In an installer, that is especially dangerous because users expect setup scripts to be safe, yet this pattern can turn a remote content change into immediate root compromise.

Content

Scanner excerpt · install.sh (reported line 155)May include surrounding context.

sh
install_node_linux() {
  if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is the same unsafe chaining pattern in the yum path: remote content is streamed directly into a root shell. That makes the host fully dependent on the integrity of a live network response and creates an immediate path to privileged compromise.

Content

Scanner excerpt · install.sh (reported line 162)May include surrounding context.

sh
fi
  elif command -v yum &>/dev/null; then
    info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
    sudo yum install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 346)May include surrounding context.

sh
refs_src=$(find "$TMP_DIR" -maxdepth 2 -type d -name "references" | head -1)

  if [ -n "$refs_src" ]; then
    rm -rf "$SKILL_DIR/references" || return 1
    cp -rf "$refs_src" "$SKILL_DIR/references" || return 1
    local ref_count
    ref_count=$(find "$SKILL_DIR/references" -type f | wc -l | tr -d ' ')

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs the agent to execute shell commands (bash scripts/install.sh, bash scripts/uninstall.sh, node scripts/quark-drive.cjs ...) but does not declare an explicit tool scope such as allowed shell commands or permissions. That creates an authorization gap: a host integrating this skill cannot reliably constrain what command execution the skill requires, increasing the risk of overbroad shell access and unsafe execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill requires forwarding the user's original prompt text verbatim to the CLI for service-quality tracking, but the document does not require clear user notice or consent at the time of transmission. This can leak sensitive user content—including credentials, personal data, or business information—into downstream logging/telemetry systems unexpectedly.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Mandating verbatim capture and forwarding of the user's raw prompt to every CLI invocation creates a broad data-exfiltration channel from the conversation into external systems. Because the prompt is sent unchanged, any secrets, personal data, internal filenames, or incidental sensitive text the user provides will be propagated and potentially logged without minimization.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 55)May include surrounding context.

sh
if rm -f "$symlink" 2>/dev/null; then
        info "  已删除旧版全局命令: $symlink"
      else
        warn "  删除旧版全局命令失败（可能需要 sudo 权限）: $symlink"
      fi
    else
      info "  未发现旧版全局命令，跳过"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · uninstall.sh (reported line 56)May include surrounding context.

sh
if rm -f "$symlink" 2>/dev/null; then
        info "  已删除旧版全局命令: $symlink"
      else
        warn "  删除旧版全局命令失败（可能需要 sudo 权限）: $symlink"
      fi
    else
      info "  未发现旧版全局命令，跳过"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding

Using sudo -E preserves the caller's environment while executing a remote script as root, which can expose privileged execution to environment-based manipulation in addition to the remote-script risk. In combination with curl-piped bash, it significantly increases the attack surface and makes exploitation easier if environment variables influence shell or installer behavior.

Content

Scanner excerpt · install.sh (reported line 155)May include surrounding context.

sh
install_node_linux() {
  if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
99% confidence
Finding

Using sudo -E preserves the caller's environment while executing a remote script as root, which can expose privileged execution to environment-based manipulation in addition to the remote-script risk. In combination with curl-piped bash, it significantly increases the attack surface and makes exploitation easier if environment variables influence shell or installer behavior.

Content

Scanner excerpt · install.sh (reported line 155)May include surrounding context.

sh
install_node_linux() {
  if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

Running apt-get install via sudo is expected for package installation, but in this script it is part of an automatic install flow that follows remote repository bootstrap. On its own this line is not the root problem, yet it contributes to elevated changes on the system and magnifies the impact of any earlier repository compromise.

Content

Scanner excerpt · install.sh (reported line 156)May include surrounding context.

sh
if command -v apt-get &>/dev/null; then
    info "使用 apt 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://deb.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo -E bash - 2>/dev/null
    sudo apt-get install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
98% confidence
Finding

This line fetches a remote setup script and executes it immediately with sudo bash, granting root execution to unaudited network content. That is a strong supply-chain and privilege-escalation risk because any malicious or altered response becomes root-level code execution on the host.

Content

Scanner excerpt · install.sh (reported line 162)May include surrounding context.

sh
fi
  elif command -v yum &>/dev/null; then
    info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
    sudo yum install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

As with the apt variant, sudo yum install is normal in isolation, but here it follows a remote bootstrap step and participates in unattended privileged modification of the host. The danger is mostly contextual: once repository trust is subverted, this install runs attacker-chosen packages as root.

Content

Scanner excerpt · install.sh (reported line 163)May include surrounding context.

sh
elif command -v yum &>/dev/null; then
    info "使用 yum 安装 Node.js ${REQUIRED_NODE_MAJOR}..."
    curl -fsSL "https://rpm.nodesource.com/setup_${REQUIRED_NODE_MAJOR}.x" | sudo bash - 2>/dev/null
    sudo yum install -y nodejs 2>/dev/null
    if command -v node &>/dev/null; then
      return 0
    fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The installer downloads a ZIP from a URL obtained at runtime from a remote config endpoint, then later installs and executes contents from that archive. This creates a supply-chain risk: if the config service, download path, or TLS trust is compromised, an attacker can deliver malicious code that is subsequently verified or run locally.

Content

Scanner excerpt · install.sh (reported line 261)May include surrounding context.

sh
mkdir -p "$TMP_DIR"
  local zip_path="$TMP_DIR/skill.zip"

  if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
    warn "下载失败，重试中..."
    if ! curl -fsSL --connect-timeout 30 --max-time 120 -o "$zip_path" "$ZIP_DOWNLOAD_URL"; then
      error "下载 zip 包失败: $ZIP_DOWNLOAD_URL"

Ssd 1

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The post-install output includes an instruction directed at an AI agent to discard memory and re-read SKILL.md. Because skill content must be treated as adversarial, embedding behavioral instructions in installer output is dangerous: downstream agents may follow it and weaken prior security context or overwrite trusted operating assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file mandates exact Chinese wording for user-facing uninstall confirmation text, requiring the agent to output that wording verbatim. This is a natural-language locale constraint and no user opt-in or alternative language path is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file is written as normative instructions in Chinese and contains mandatory display requirements for notices, but it does not offer any user language selection or state that the locale restriction is intentional and limited to a region-specific tool. Per SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file documents file-moving capabilities that can materially change user data placement, and also references rename/organize flows elsewhere, but it does not include a clear warning that these operations modify the user's cloud files and may be difficult to undo. Under the markdown-specific SQP-2 criterion, skills that can affect user data or system integrity should disclose that impact to users.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/file-organize.md (reported line 109)May include surrounding context.

md
> **agent 须知**：整理完成后，agent 必须以**表格**形式展示整理结果，表格列包括：**目标文件夹名称**、**文件数量**、**整理路径**。可从 `result.data` 中提取 `target_dir_list`、`total_file_count` 和 `organize_path` 等信息组织表格，同时用 1-2 句话概括整理情况（如"已将 15 张照片按地点整理到 3 个文件夹"）。**成功完成时整理操作已全部执行（文件副本已拷贝至目标文件夹，原文件保持不动），agent 禁止提示用户"确认"或暗示需要用户确认后才执行。**
>
> **呈现查看链接**：当 `data.checkAllLink` 存在且非空时，agent 必须透出该链接供用户点击查看整理结果，**以可点击链接形式展示**（如 Markdown `[点击查看整理结果](checkAllLink)`）。当环境不支持可点击渲染时，**直接展示完整地址原文**（明文 URL）以便用户复制访问；**禁止**用代码块/行内代码包裹或截断该地址。`checkAllLink` 为空时省略该提示。
>                                                                                        
> **agent 须知（零结果场景）**：当整理正常完成但 `total_file_count` 为 `0` 时，表示整理流程正常完成但未找到符合条件的文件。agent 回复用户时**必须使用自然语言描述**（如"网盘中没有找到符合条件的文件"），**严禁**在回复中暴露任何内部字段名（如 `total_file_count`、`finish`、`task_id` 等）。错误示例：~~"结果显示 total_file_count：0，意思是没有找到文件"~~；正确示例："整理完成，但网盘中没有找到符合你描述的文件，可以尝试调整整理范围后重试"。

#### 需确认出参（finish_reason 非 STOP）

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document permits a move-based confirmation flow for large-scale photo organization but does not give a clear upfront warning at the point of choice that 'move' relocates originals and may make rollback harder if the result is wrong. In a file-management skill, this can cause unintended destructive changes because users may interpret organization as a safe copy-like action, especially since the default behavior elsewhere is copy.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
references/auth.md:68