baidu-netdisk-skills

• Outcome: Review
• Latest audit: Aug 14, 2026 · 8:36 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Baidu Netdisk manager, but it has enough under-disclosed high-impact actions that users should review it carefully before installing.

Install only if you are comfortable granting this skill access to your Baidu Netdisk account and letting it install/run the bdpan CLI. Before approving operations, check exact local paths, Netdisk paths, share recipients/expiration, and any restore overwrite list. Treat updates as modifying local skill files, and avoid pasting authorization codes in shared or logged terminals.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description presents itself primarily as a Baidu Netdisk file-management skill, but the body also authorizes installation, update, uninstall, login-state manipulation, and execution of remotely obtained software. That mismatch is dangerous because users or calling systems may grant trust for routine file operations while the skill can also change the local environment and execute code downloaded from external infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The advanced examples go beyond documenting Baidu Netdisk operations and introduce arbitrary shell scripting that creates archives, writes to /tmp, loops over local files, and deletes local data. In an agent-skill context, examples often shape model behavior, so this can normalize or induce local filesystem modification outside the skill's stated scope and without the stronger confirmation patterns shown elsewhere in the file.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The confirmation prompt claims the update '仅 Skill 文档/脚本，不会修改用户网盘内容或本地文件', but the script actually downloads an archive, unzips it into the skill directory, and overwrites local files including VERSION. This is a misleading security boundary: a user may approve an update under the false belief that no local files are changed, reducing informed consent for a code-modifying operation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The share command creates public or semi-public links and exposes extraction codes, but the documentation does not prominently warn that this can disclose private user data outside the account boundary. In an agent context, missing a strong disclosure/confirmation requirement increases the chance of unintended data exposure through routine automation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The transfer examples save content into the user's Baidu Netdisk immediately, but unlike upload/share and download flows, they do not require a confirmation step or warn that this writes data into the user's cloud storage. That inconsistency is dangerous because agents may treat transfer as a low-risk read-like action when it is actually a state-changing write operation that can import unwanted, illegal, or sensitive content into the user's account.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prints the user-supplied 32-character authorization code back to stderr when validation fails. Even though this is framed as a usability aid, the code is a sensitive login credential and echoing it can expose it to terminal scrollback, shell/session logging, CI logs, remote terminal recording, or shared support transcripts. In the context of a Baidu Netdisk login skill, this is more dangerous because the token grants access to cloud-stored user data and the skill explicitly supports high-risk file operations and memory backup/restore.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 风险等级 | 操作 | 策略 |
|----------|------|------|
| **高（必须确认）** | `rm` 删除、上传/下载目标已存在同名文件 | 列出影响范围，等待用户确认 |
| **中（路径模糊时确认）** | upload、download、mv、rename、cp | 路径明确直接执行，不明确则确认 |
| **低（直接执行）** | ls、search、whoami、mkdir、share | 无需确认 |

• Confidence: 80% confidence
• Finding: The skill permits destructive and state-changing shell-backed operations such as `rm`, upload/download overwrite scenarios, and move/copy/rename flows, with some cases allowed to execute directly when paths are considered clear. In an agent setting, this is risky because natural-language ambiguity, prompt injection through filenames/content, or mistaken path resolution can still lead to unintended data deletion, overwrite, sharing, or exfiltration via shell-invoked tooling.

Static analysis

No suspicious patterns detected.