Skills/ClawHub/cloud-drive-downloader

cloud-drive-downloader@0.20.2

CAUTION· install only

Publisher claims: "跨 macOS / Windows / Linux 的通用下载调度层，统一通过 Agent/MCP/CLI、Web UI 和浏览器插件投递任务；调度本机或可选 Docker/远程引擎。不解析分享页、不提取直链、不绕过鉴权/限速/风控/DRM。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher lisong2003-lgtm · publishing for 31 daysInstalls 483Last detonated 46 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Destructive file system command detected; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commandscripts/lint_cross_platform.py:67 · Privileged sudo command — agent may execute with elevated privileges"dylib 是 macOS 原生库格式。fix: 仓库内 sudo 二进制请走 platform 分支；Windows/Linux 由 pip wheel 提供"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/lint_cross_platform.py:105 · Python subprocess execution detected# 仅对命令类规则，在 .py 里只追 subprocess.run([...]) 这样的真实调用。Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/clipboard_monitor.py:48 · Python subprocess execution detectedproc = subprocess.run(argv, capture_output=True, text=True, timeout=8)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engine.py:941 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engine.py:1046 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Destructive file system command detectedscripts/pancli/docker.py:36 · Destructive file system command detected" && apt-get clean && rm -rf /var/lib/apt/lists/*\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engines.py:58 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=10, env=env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/pan_web.sh:27 · Process kill command — agent can terminate processesecho "[pan_web] 剪贴板监听运行中（PID $CLIP_PID）。停止：kill $CLIP_PID"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/carriers.py:100 · Python subprocess execution detectedproc = subprocess.run(argv, capture_output=True, text=True, timeout=0)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/carriers.py:181 · Python subprocess execution detectedproc = subprocess.run(["curl", "-sS", "--config", "-"], input=cfg_curl,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engine.py:929 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engine.py:1055 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/idle.py:157 · Python subprocess execution detectedrc = subprocess.call(argv, stdout=lf, stderr=lf)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/pancli/setup.py:51 · Privileged sudo command — agent may execute with elevated privileges"依赖安装：sudo apt-get install -y aria2 yt-dlp libsecret-tools；或 sudo dnf install -y aria2 yt-dlp libsecret",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/engine.py:917 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/baidu_login.py:252 · Python subprocess execution detectedproc = subprocess.run([engine, "who"], capture_output=True, text=True, timeout=15)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/pancli/docker.py:41 · File permission modification command — agent changes file ownership/permissions" chown -R pan:pan /app /data\n"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/pan_mcp.py:142 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, env=_env())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/docker.py:356 · Python subprocess execution detectedproc = subprocess.Popen(_argv(start, end, part), stdout=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/report.py:785 · Python subprocess execution detectedproc = subprocess.Popen(argv, stdin=subprocess.PIPE if input_data is not None else None,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/verify_real_env.py:93 · Python subprocess execution detectedwhich = subprocess.run(["which", "rclone"], capture_output=True, text=True).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/web.py:421 · Python subprocess execution detectedproc = subprocess.Popen(argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Dense URL-encoded contentscripts/self_test.py:280 · Dense URL-encoded content — may be obfuscating payloadsp_dav = pan.build_plan("https://dav.jianguoyun.com/dav/%E6%96%87%E4%BB%B6.zip", cfg=cfg_dav)Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/pancli/web.py:323 · Python subprocess execution detectedproc = subprocess.Popen(argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/report.py:160 · Python subprocess execution detectedproc = subprocess.run(argv, capture_output=True, text=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/remote.py:474 · Python subprocess execution detectedproc = subprocess.run(remote_ssh_argv(profile, cmd), capture_output=True, text=True, timeout=20)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Dense URL-encoded contentscripts/self_test.py:206 · Dense URL-encoded content — may be obfuscating payloadsassert pan.filename_from_url("https://x.com/%E6%96%87%E4%BB%B6.zip") == "文件.zip"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/verify_real_env.py:114 · Python subprocess execution detectedp = subprocess.run([sys.executable, str(ROOT / "scripts" / "pan_mcp.py")], input=payload,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/verify_real_env.py:38 · Python subprocess execution detectedreturn subprocess.run([sys.executable, str(PAN)] + args, capture_output=True, text=True, env=e, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/pancli/web.py:860 · File type combined with upload action — agent may exfiltrate local data files…tton><div class=msg id=msg></div></div> <script>fetch('/api/settings').then(r=>r.json()).then(d=>{const c=d.config||{};const e=c.engines||{};alist.value=e.alist_url||'';remote.value=e.rclone_remote||'';root.value=c.download_root||'';conn.v…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/pancli/remote.py:483 · Python subprocess execution detectedproc = subprocess.run(["rclone", "lsd", destination], capture_output=True, text=True, timeout=20)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pancli/web.py:133 · Python subprocess execution detectedproc = subprocess.Popen(argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈1,217 tok
1 file · 98 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim lisong2003-lgtm: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lisong2003-lgtmPropose a patch to the maintainer