ClawHub
Back to skill

Security audit

Baidu Pan Upload

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Baidu Netdisk uploader, but users should understand it handles access tokens and writes resumable-upload state locally.

Install only if you are comfortable giving the skill a Baidu Netdisk access token and uploading selected local files to Baidu. Avoid running it in shared directories or on multi-user machines with sensitive tokens, because the token may be visible in the curl command line while uploads run and the resume state file is written beside the source file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload.py:191
Finding

Access Token Exposed Through the curl Process Command Line

Content
View full analysis
/cmdline`, process-monitoring software, endpoint telemetry, diagnostic tools, or audit logs. Access controls around process arguments vary by operating system and deployment configuration, but the implementation unnecessarily expands local exposure of a reusable credential. Sending the access token to the documented Baidu endpoint is necessary for the declared upload function. Exposing it through a child process command line is not necessary and exceeds the minimum credential exposure required to perform the upload. ### Attack Path 1. A victim starts an upload using a valid Baidu Pan access token. 2. The script launches `curl` with the access token embedded in its URL argument. 3. A local user, monitoring agent, or process-inspection tool c ...[truncated 653 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload.py:105
Finding

Predictable Upload State File Permits Symbolic-Link Following and State Collisions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/upload.py:365
Finding

Failed Uploads Can Leave Plaintext File Chunks in Temporary Storage

Content
View full analysis
= 50 else 1 if len(done_chunks) % save_interval == 0 or len(done_chunks) == total_chunks: save_state(local_file, remote_path, upload_id, total_chunks, block_list, list(done_chunks)) except KeyboardInterrupt: # Save state on Ctrl+C so we can resume save_state(local_file, remote_path, upload_id, total_chunks, block_list, list ...[truncated 2307 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/example.env (reported line 2)May include surrounding context.

text
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents executable shell and network behavior but does not declare any tool scope or permission boundaries. In an agent environment, this increases the chance of overbroad execution, making it easier for the skill to invoke shell commands and perform network uploads without explicit user-visible restriction.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/example.env (reported line 3)May include surrounding context.

text
# 百度网盘开放平台应用凭据
# 复制此文件为 .env 并填入实际值
# 获取方式：https://pan.baidu.com/union/console/applist

AppID=your_app_id
AppKey=your_app_key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code reads an AccessToken from a local .env file and includes it in outbound API requests to Baidu Netdisk. Although uploading inherently requires network activity, the script does not explicitly disclose at runtime or in comments near the credential handling that the token will be used and transmitted to external endpoints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill's stated purpose is uploading files to Baidu Pan with resume and progress support. While network access is expected, spawning an external executable via subprocess introduces an additional capability—executing local programs—that is not justified by the manifest and is materially broader than a pure uploader implementation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upload.py (reported line 215)May include surrounding context.

python
for attempt in range(3):
        try:
            result = subprocess.run(
                ['curl', '-s', '-X', 'POST', full_url,
                 '-H', 'User-Agent: pan.baidu.com',
                 '-F', f'file=@{chunk_filepath}',

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring, usage explanations, and console messages are all Chinese-language only, which constitutes a language/locale constraint in natural-language behavior. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comment claims the function cannot compute the source file MD5 because it lacks the file path, yet the code immediately sets content_md5 using md5_of_file(remote_path), which treats the remote path string as a local filesystem path. Although the value is deleted before the request is sent, the comment and code behavior contradict each other.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.