T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:192- Finding
Defective Path Traversal Validation Allows Namespace Escape
- Content
View full analysis
- Remediation
View remediation
Security audit
Pan File Commander Free
Security checks for vulnerabilities and agentic risk
Overview
This Baidu Netdisk file-management skill is mostly purpose-aligned, but it has under-scoped execution and consent issues that users should review before installing.
Install only if you are comfortable granting an agent command-line access to manage your Baidu Netdisk files. Review or replace the missing installer scripts, avoid --yes automation for install/update/uninstall, require explicit confirmation for uploads, deletes, moves, overwrites, and public shares, and ignore the unrelated SEO trigger text.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Warning
- Location
SKILL.md:250- Finding
Downloaded Executable Is Run Without Cryptographic Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:27- Finding
Conflicting Confirmation Rules Can Cause Unapproved File Operations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ## 确认规则(差异化:分层风险模型) | 风险等级 | 操作 | 策略 | 示例 | | --- | --- | --- | --- | | **高(必须确认)** | `rm` 删除、上传/下载目标已存在同名文件 | 列出影响范围,等待用户确认 | `bdpan rm docs/old.txt` | | **中(路径模糊时确认)** | upload、download、mv、rename、cp | 路径明确直接执行,不明确则确认 | `bdpan mv docs/ archive/` | | **低(直接执行)** | ls、search、whoami、mkdir、share | 无需确认 | `bdpan ls docs/` |
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bdpan mkdir docs/new-folder
bdpan rm docs/unwanted.txt
text ### 分享类快捷命令
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
validate_path "docs/file.txt" # 通过 validate_path "../etc/passwd" # 拒绝 validate_path "/etc/passwd" # 拒绝
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
validate_path "docs/file.txt" # 通过 validate_path "../etc/passwd" # 拒绝 validate_path "/etc/passwd" # 拒绝
text
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The final trigger section says the skill should be used for SEO optimization, keyword analysis, and ranking improvement, which is unrelated to the rest of the document's Baidu Netdisk file-management purpose. This contradiction can cause incorrect activation in unrelated contexts and may lead an agent to invoke file-management tools when the user is asking about SEO, expanding the skill's execution surface unexpectedly.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The conflicting trigger condition at the end introduces a broad and unrelated activation rule, making the skill eligible for invocation during SEO-related requests that have nothing to do with cloud file management. Overly broad or contradictory triggers are dangerous because they can bypass user expectations and cause tool use in the wrong task context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions prescribe exact Chinese phrasing for user follow-up, such as asking '您指的是百度网盘(pan.baidu.com)吗?'. Throughout the file, user-facing prompts and outputs are specified only in Chinese, with no option for the user's preferred language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill exposes an uninstall command that can remove locally installed components, but it does not present a clear user-facing warning about destructive system changes or potential data/configuration loss. In an agent context, such omissions increase the chance that users authorize or agents suggest destructive maintenance actions without understanding consequences.
- Content