The skill is highly vulnerable to prompt injection and arbitrary
Claims to do
百度网盘存储 Skill: 百度网盘文件管理工具,所有操作限制在 `/apps/bdpan/` 目录内。适配 Claude Code、DuClaw、OpenClaw 等。
Actually does
This skill uses Bash, Read, Glob, Grep, and AskUserQuestion to manage files on Baidu Netdisk. It executes `bdpan` commands for operations like listing, uploading, downloading, sharing, searching, moving, copying, renaming, and creating directories, strictly within the `/apps/bdpan/` cloud path. It also runs local scripts (`login.sh`, `install.sh`, `update.sh`, `uninstall.sh`) and contacts `issuecdn.baidupcs.com` for installation.
openclaw skills install may-yaha/baidu-netdisk-storageDeBERTa classifier detected prompt injection (confidence: 0.91)
The skill downloads files from Baidu Netdisk and processes shared links from external sources. Malicious files or shared content could contain embedded instructions (indirect prompt injection) that the agent reads and acts upon, potentially overriding the security constraints defined in this skill, exfiltrating credentials, or performing unauthorized operations.
bdpan download <远端路径> <本地路径> ... bdpan download "https://pan.baidu.com/s/1xxxxx?pwd=abcd" ./downloaded/
The skill references several external markdown files (bdpan-commands.md, authentication.md, examples.md, troubleshooting.md, reference/notes.md) to be loaded by the agent on demand. If these files are tampered with or replaced (e.g., via a supply chain attack on the skill directory), they could inject malicious instructions into the agent's context at runtime.
遇到对应问题时按需查阅,无需预加载 ... [bdpan-commands.md](./reference/bdpan-commands.md) ... [authentication.md](./reference/authentication.md)
The skill downloads and executes `install.sh` (and likely `update.sh`) from a Baidu CDN without performing any integrity checks (e.g., SHA256 hash verification). This makes the skill vulnerable to supply chain attacks if the CDN or the script hosted on it is compromised, leading to arbitrary code execution on the agent's host.
安装器从百度 CDN(`issuecdn.baidupcs.com`)下载并执行。注意:install.sh 不执行本地 SHA256 校验,完整性依赖 HTTPS 传输保护。
The skill extensively uses `Bash` to execute `bdpan` commands, often incorporating user-provided paths and arguments. Although the skill states '路径安全' (path safety) and prohibits path traversal, the content does not detail the sanitization mechanisms. Without robust input sanitization, a malicious user could inject arbitrary commands.
`allowed-tools: Bash`, `bdpan upload <本地路径> <远端路径>`, `bdpan download <远端路径> <本地路径>`
The `Read` tool is explicitly allowed, granting the agent the capability to read arbitrary files. While the skill defines path safety for `bdpan` operations, it does not specify how the `Read` tool will be used or if its file access is similarly restricted, posing a risk for unauthorized data access or exfiltration if user input can control the file path.
`allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion`
During the large file download process, the agent uses `ls -l <本地路径>` to check the downloaded file size. If the `<本地路径>` argument is not sufficiently validated and can be influenced by a malicious user, this could be exploited to enumerate arbitrary files or directories on the local filesystem outside the intended scope.
`ls -l <本地路径> 2>/dev/null;` within the '轮询检查进度' section.
The skill employs `nohup` for background downloads, which can make process monitoring and termination more complex for the agent. While necessary for long-running tasks, it introduces a slight risk of orphaned processes or resource consumption if not managed carefully, though the skill does include polling and cleanup.
`nohup bdpan download ... & echo $!`
The skill instructs the agent to spawn background processes using nohup and write output to /tmp with a predictable naming pattern (/tmp/bdpan-dl-$$.log). This creates persistent background processes outside the agent's control, and the /tmp log path with PID-based naming could be subject to symlink attacks or log injection if an attacker can predict or influence the PID.
nohup bdpan download <远端路径> <本地路径> > /tmp/bdpan-dl-$$.log 2>&1 & echo $!
The skill prohibits reading ~/.config/bdpan/config.json which contains access_token credentials. However, the skill also grants broad Bash tool access. A crafted user instruction or indirect prompt injection through file content (e.g., a downloaded file containing instructions) could attempt to override this constraint and exfiltrate the token, as the constraint is only enforced by the skill's text instructions rather than a technical sandbox.
禁止读取或输出 `~/.config/bdpan/config.json` 内容(含 access_token 等敏感凭据)
The path safety constraint prohibiting '..' and '~' and restricting operations to /apps/bdpan/ is enforced only through the LLM's adherence to skill instructions, not through a technical sandbox or shell-level restriction. An adversarial user input or injected content could craft inputs that bypass this soft constraint.
禁止路径穿越(`..`、`~`)、禁止访问 `/apps/bdpan/` 范围外的绝对路径
The skill instructs the agent to poll a background download process every 30 seconds without specifying a maximum number of retries or a timeout ceiling. For very large files or hung processes, this could result in the agent being occupied indefinitely in a polling loop, constituting a resource abuse / autonomy abuse pattern.
# 2. 轮询检查进度(每 30 秒检查一次,使用 Bash run_in_background)
The note '内测阶段' (internal testing phase) could subtly influence human overseers or developers to be less critical of potential issues, framing them as expected imperfections in an early development stage.
> 内测阶段,使用注意事项详见 [reference/notes.md](./reference/notes.md)
[](https://mondoo.com/ai-agent-security/skills/clawhub/may-yaha/baidu-netdisk-storage)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/may-yaha/baidu-netdisk-storage"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/may-yaha/baidu-netdisk-storage.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/may-yaha/baidu-netdisk-storage.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.