ClawHub
Back to skill

Security audit

Aliyun Drive Uploader

Security checks for vulnerabilities and agentic risk

Overview

This Aliyun Drive skill is mostly coherent for cloud file management, but it has unsafe command execution and credential-handling weaknesses that warrant manual review before installation.

Install only after the command execution path is fixed to use argument-vector subprocess execution, the token is no longer passed on the command line, dependencies are pinned, and destructive delete actions require explicit user confirmation. Treat the Aliyun refresh token like a password and avoid committing or sharing the .env file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:43
Finding

Shell Command Injection and Refresh Token Exposure Through Process Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Python Dependencies Permit Non-Reproducible and Unsafe Package Resolution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This code accesses credentials from a local .env file, which is a sensitive secret source. In agent/plugin contexts, credential access is high risk because compromise of the skill or misuse of its capabilities can lead to unauthorized cloud account actions using long-lived refresh tokens.

Content

Scanner excerpt · index.js (reported line 20)May include surrounding context.

js
];

/**
 * 从 .env 读取 token
 */
function getEnvToken() {
  const envPath = resolve(process.cwd(), '.env');

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Reading the .env file contents directly into memory to extract a refresh token constitutes explicit credential access. Because the token likely permits account operations such as file management and sharing, exposure or misuse could enable unauthorized access to the user's cloud storage.

Content

Scanner excerpt · index.js (reported line 23)May include surrounding context.

js
* 从 .env 读取 token
 */
function getEnvToken() {
  const envPath = resolve(process.cwd(), '.env');
  if (!existsSync(envPath)) return null;
  const content = readFileSync(envPath, 'utf8');
  const match = content.match(/ALIYUN_DRIVE_REFRESH_TOKEN="([^"]+)"/);

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The code depends on a refresh token sourced from .env and fails if it is absent, confirming credential access is core behavior. In this context, the danger is elevated because the skill can perform state-changing cloud actions once the token is obtained, broadening the blast radius of any misuse.

Content

Scanner excerpt · index.js (reported line 51)May include surrounding context.

js
*/
async function execPython(args) {
  const token = getEnvToken();
  if (!token) throw new Error('ALIYUN_DRIVE_REFRESH_TOKEN not found in .env');

  const envPath = resolve(process.cwd(), '.env');
  const python = findPython();

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The refresh token is passed on the command line to a Python subprocess together with the .env path for saving, which is especially dangerous because command-line arguments are often observable via process listings, logs, or crash reports. This creates a concrete secret-exposure path beyond mere local credential access.

Content

Scanner excerpt · index.js (reported line 53)May include surrounding context.

js
const token = getEnvToken();
  if (!token) throw new Error('ALIYUN_DRIVE_REFRESH_TOKEN not found in .env');

  const envPath = resolve(process.cwd(), '.env');
  const python = findPython();
  const cmd = [python, PYTHON_SCRIPT, ...args, '--token', token, '--save-token', envPath];

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The --save-token argument allows the caller to specify an arbitrary local file that will be read and rewritten with a regex replacement. This creates an unintended local file modification primitive that can overwrite sensitive configuration files outside the intended Aliyun Drive scope, potentially corrupting configs or altering credentials on the host.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises capabilities that imply file read, file write, and network access, but it does not declare any explicit tool scope or permission boundaries. That creates ambiguity for the agent/runtime and can lead to over-broad execution privileges, especially because this skill handles local files and cloud uploads using sensitive credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to extract a refresh_token from browser storage and save it in a local .env file without clearly warning that this token is a long-lived credential that can grant full account access. If exposed through logs, backups, local compromise, or accidental sharing, an attacker could access, upload, delete, or share files in the user's Aliyun Drive account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documents a delete capability but provides no warning about irreversible data loss and no expectation of explicit confirmation before performing destructive actions. In an agent setting, that omission increases the chance of accidental or unauthorized deletion of cloud files, especially when operating on IDs the user may not easily recognize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The execution path accesses and forwards a refresh token to another process without any user-facing disclosure in this file's control flow. Even if needed for functionality, undisclosed credential handling is risky in an agent skill because users may not realize local secrets are being read and transmitted to subprocesses.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code exposes a destructive delete capability that is not disclosed in the skill metadata, creating a mismatch between declared and actual behavior. In an agent setting, hidden destructive actions materially increase user risk because callers may invoke or permit the skill without understanding it can permanently remove cloud files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delete path executes immediately once given a file_id and contains no confirmation, safeguard, or dry-run mechanism. In a file-management skill, lack of friction around destructive operations increases the chance of accidental or manipulated deletion through prompt confusion or upstream agent mistakes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/api.py (reported line 29)May include surrounding context.

python
pan = AliyunPan(refresh_token=token)

    # 直接调 auth API 绕过 SDK bug
    resp = requests.post(
        'https://auth.aliyundrive.com/v2/account/token',
        json={"refresh_token": token, "grant_type": "refresh_token"},
        timeout=10

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/api.py (reported line 29)May include surrounding context.

python
pan = AliyunPan(refresh_token=token)

    # 直接调 auth API 绕过 SDK bug
    resp = requests.post(
        'https://auth.aliyundrive.com/v2/account/token',
        json={"refresh_token": token, "grant_type": "refresh_token"},
        timeout=10

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code sends the user-supplied refresh token to https://auth.aliyundrive.com/v2/account/token to obtain access credentials. Although network use is intrinsic to cloud-drive functionality, there is no visible print/log/confirmation or comment near the CLI interface warning users that their credential will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/api.py (reported line 60)May include surrounding context.

python
parent_id = ensure_folder(pan, target_folder, parent_id)

    # 上传
    result = pan.upload_file(parent_file_id=parent_id, path=path)
    
    # upload_file 可能返回: str(file_id), False, None, 或 Response 对象
    if isinstance(result, str):

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description highlights uploading files, creating folders, searching files, and managing share links, but it does not mention deleting cloud files. The code exposes a delete action that permanently modifies remote content, which is a materially broader behavior than the described examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The delete operation performs an irreversible remote action with no confirmation, dry-run mode, or safety checks. In agent-driven contexts, this raises the risk of accidental or prompt-induced destructive behavior against user cloud data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code silently modifies stored credentials by writing a refreshed token back to disk, which is a sensitive side effect with no user-facing confirmation. Because the write target is user-controlled via --save-token, this also increases the chance of accidental or unsafe credential handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language comments identify the skill solely in Chinese and do not offer any language choice or opt-in. Under the locale policy, language constraints should be optional or clearly justified rather than implicitly forced.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill reads a refresh token directly from a local .env file without declaring that credential access behavior. In an agent environment, silent local secret consumption is dangerous because it expands trust boundaries and may use credentials the user did not intend to expose to this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code implements download-link retrieval and user account info access, but these capabilities are not clearly described in the skill metadata. Undisclosed data-access features reduce transparency and can expose file access URLs or account details in contexts where users only expected upload or folder-management behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The top-level docstring describes the skill exclusively in Chinese and does not offer an alternate language or indicate that the locale restriction is intentional. This can violate language policy expectations when users are not given a choice of language.

Content

No source excerpt is available for this finding.