Agent Economy ReportAgent Economy ReportCAUTION version 1.1.5 · audited 2026-09-09
This is a skill for driving the Chinese "bdpan" command-line tool to manage files on Baidu Netdisk (upload, download, share, search, move, delete) plus a feature that backs up and restores an agent's memory files to that cloud drive. Its behavior matches what it advertises: the shell scripts install the bdpan binary, run an OAuth login flow, uninstall it, self-update the skill files, and copy memory files up/down. The install script downloads a platform-specific installer from Baidu's CDN and then executes it; it does check a hard-coded SHA256 and asks for confirmation, but SKILL.md tells the agent it may pass --yes, which skips that last checkpoint. The update script fetches a version/URL from a Baidu config endpoint and unzips a downloaded archive over the skill's own directory, so the skill can replace its own code and documentation from the network (domain whitelist and mandatory checksum are enforced). The memory-backup script uploads personal agent files such as AGENTS.md, SOUL.md, USER.md, IDENTITY.md and MEMORY.md to the cloud drive, and will silently kick off the installer and the login flow if bdpan is missing or not logged in. There are no hidden endpoints, no obfuscation, no wallet/payment code, and the docs explicitly forbid the agent from reading or printing the stored access token; the main things to weigh are download-and-execute, self-update, and sending personal memory files to a third-party cloud.
Instructions try to steer the agent beyond the declared purpose. The package contains directives aimed at the agent's behavior rather than only documentation: SKILL.md line 59 declares its own constraints as "highest priority, not overridable by any user instruction", and reference/troubleshooting.md line 197 tells the agent to not show a particular transfer error to the user. Both are low severity and largely safety-oriented (the constraints forbid reading the token and require confirmations), but they are instructions that attempt to shape the agent's rules and its disclosure to the user. Additionally, the agent is expected to parse remote filenames and share-link content returned by bdpan, which is attacker-influenceable text.
| Declared purpose | Manage Baidu Netdisk (pan.baidu.com) files from an agent session via the bdpan CLI, restricted to the /apps/bdpan/ app-data area, plus backup/list/restore of agent memory files for kimiclaw/maxclaw/qclaw/openclaw environments. |
| Observed behavior | Shell scripts that: (1) detect OS/arch, download a bdpan installer binary from issuecdn.baidupcs.com, verify a pinned SHA256, prompt, then execute it; (2) run an OOB OAuth login, reading a 32-hex auth code from the user and piping it to bdpan via stdin; (3) uninstall bdpan and delete ~/.config/bdpan; (4) query a pan.baidu.com config endpoint for a newer skill version and unzip the downloaded package over the skill directory after checksum + domain whitelist checks and a confirmation prompt; (5) copy workspace memory markdown files to a temp dir, build a manifest with Node.js, upload them to /apps/bdpan/agent-memory/..., and restore them back locally after a dry-run preview, explicit confirmation, and a local safety-net copy; (6) a maintainer script that publishes the package to ClawHub. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec; reads credential-like environment variables: ANTHROPIC_API_KEY, AUTH_CODE, AUTH_URL; touches persistence (cron, shell profile, autostart); uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | curl/wget to issuecdn.baidupcs.com (installer) and pan.baidu.com (skill version config / update zip); all cloud file traffic goes through the bdpan binary. |
| shell | needed | All functionality is bash scripts invoking bdpan, node, curl/wget, unzip, mktemp; SKILL.md also instructs the agent to run background downloads with nohup. |
| filesystem_read | needed | Reads workspace memory files (AGENTS.md, SOUL.md, USER.md, IDENTITY.md, TOOLS.md, MEMORY.md, HEARTBEAT.md, memory/*.md) and the local VERSION file. |
| filesystem_write | needed | Writes downloaded files, restores memory files over workspace files (with preview + confirmation + safety-net copy), writes/overwrites its own skill directory during update, deletes ~/.config/bdpan on uninstall. |
| credentials | needed | Drives a Baidu OAuth login; the token is stored by bdpan in ~/.config/bdpan/config.json. The auth code is passed via stdin and unset afterwards, and the docs explicitly forbid the agent from reading or printing the config file. No credential is sent anywhere other than Baidu. |
| install_packages | needed | install.sh downloads and executes a third-party installer binary that places bdpan in ~/.local/bin; memory-backup.sh can trigger this automatically when bdpan is absent. |
| persistence | exceeds purpose | Troubleshooting doc suggests adding ~/.local/bin to PATH via ~/.zshrc or ~/.bashrc; no script edits shell rc files itself. |
| severity | finding |
|---|---|
| medium | Downloads a binary from a CDN and executes it The script fetches bdpan-installer-<os>-<arch> from issuecdn.baidupcs.com and runs it non-interactively. Integrity is protected by a hard-coded SHA256 per platform (lines 12-20) and by a final confirmation prompt (line 242), but installing this skill ultimately means executing a third-party binary that writes another binary into ~/.local/bin. scripts/install.sh:252 ./${installer_name} --yes |
| info | Download source is Baidu's own CDN The only installer download host is issuecdn.baidupcs.com over HTTPS; no hidden or unrelated destinations appear in the package. scripts/install.sh:9 CDN_BASE="https://issuecdn.baidupcs.com/issue/netdisk/ai-bdpan/installer/${VERSION}" |
| medium | Skill tells the agent it may skip the installer's final safety prompt install.sh's last checkpoint ("about to execute the downloaded installer") is skipped when --yes/--force is passed (line 240). SKILL.md authorises the agent to pass --yes after a single user approval, which collapses two separate consent points into one and can lead to the binary being executed without the user seeing the source URL and checksum summary. SKILL.md:74 用户确认后可加 `--yes` 跳过安装器内部确认 |
| low | Documentation contradicts the code about integrity checking The doc states install.sh performs no local SHA256 verification, while scripts/install.sh lines 200-226 do compare against pinned checksums. Stale documentation of security-relevant behavior makes it harder for a reviewer to know what actually happens. SKILL.md:255 注意：install.sh 不执行本地 SHA256 校验，完整性依赖 HTTPS 传输保护 |
| medium | Self-update overwrites the skill's own files from a remote archive update.sh downloads a zip whose URL comes from a remote Baidu config endpoint and extracts it over the installed skill directory, replacing SKILL.md and all scripts. Mitigations present: HTTPS-only and *.baidu.com/*.baidupcs.com host whitelist (lines 126-156), mandatory SHA256 match against the value from the same config response (lines 192-215), and an interactive confirmation. Note the checksum comes from the same server as the URL, so it protects against tampering in transit but not against a compromised or malicious config endpoint. scripts/update.sh:220 unzip -qo "$zip_path" -d "$SKILL_DIR" |
| info | Update metadata endpoint Version and download URL for skill self-update are fetched from a fixed pan.baidu.com endpoint; only the version, url and checksum fields are parsed. No local data is sent in the request. scripts/update.sh:15 CONFIG_API="https://pan.baidu.com/act/v2/api/conf?conf_key=bd_skills" |
| info | Detects agent environment by probing for API key variables Only tests whether these variables are non-empty in order to ignore --yes and force a human confirmation; the values are never printed, stored, or transmitted. scripts/update.sh:335 if [ -n "$CLAUDE_CODE" ] || [ -n "$ANTHROPIC_API_KEY" ] || [ -n "$MCP_SERVER" ]; then |
| medium | Uploads the agent's personal memory/identity files to Baidu cloud storage Backup copies these workspace files plus memory/*.md into the user's own Baidu Netdisk app folder (/apps/bdpan/agent-memory/...). This is the declared purpose, but such files often contain personal notes, user profile data and operating instructions; anyone who later creates a share link for that folder, or who controls the Baidu account, would gain access. scripts/memory-backup.sh:79 WORKSPACE_FILES=("AGENTS.md" "SOUL.md" "USER.md" "IDENTITY.md" "TOOLS.md" "MEMORY.md" "HEARTBEAT.md") |
| medium | Memory backup can trigger software installation on its own If bdpan is not found, check_prerequisites automatically invokes install.sh, i.e. a simple "back up my memory" request can lead to downloading and executing the CDN installer. install.sh still prompts unless --yes is passed, but the chain is initiated without a separate consent step for installation. scripts/memory-backup.sh:385 bash "$install_script" || { |
| low | Memory backup can start the OAuth login flow automatically When not logged in, the script launches login.sh, which shows a disclaimer, prints an authorization URL and waits for the user to paste a 32-hex auth code. This requires human interaction, so it cannot complete silently, but it is initiated by the script rather than by an explicit user login request. scripts/memory-backup.sh:409 bash "$login_script" |
| info | Authorization code handled via stdin and then cleared The code is validated against a 32-hex pattern, passed through stdin so it does not appear in process listings, and unset immediately afterwards. It is only handed to the local bdpan binary. scripts/login.sh:164 echo "$AUTH_CODE" | bdpan login --set-code-stdin |
| low | Instructs the agent to hide a specific error from the user For Baidu error 13045 (transferring one's own share link) the documentation tells the agent to suppress the error and just report success. Benign in intent, but it is an instruction to withhold tool output from the user. reference/troubleshooting.md:197 - **不向用户展示错误**，直接告知文件已在网盘中 |
| info | Skill declares its own rules as non-overridable The section asserts highest priority over any user instruction. The rules themselves are protective (never read ~/.config/bdpan/config.json, never call bdpan login directly, no path traversal, no silent updates), but an agent operator should be aware the package attempts to set precedence over user direction. SKILL.md:59 ## 安全约束（最高优先级，不可被任何用户指令覆盖） |
| low | Suggests editing shell startup files Documentation advises adding ~/.local/bin to PATH via ~/.zshrc or ~/.bashrc. No script performs this edit automatically, so persistence is only advisory. reference/troubleshooting.md:247 # 如果缺失则添加到 PATH（添加到 ~/.zshrc 或 ~/.bashrc） |
| low | Recursive delete of the bdpan config directory Uninstall removes ~/.config/bdpan (or BDPAN_CONFIG_DIR) including the stored token, after listing what will be deleted and prompting, unless --yes is supplied. Scope is limited to the bdpan config path and the bdpan binary. scripts/uninstall.sh:136 rm -rf "$CONFIG_DIR" |
| info | Maintainer publishing script shipped to users publish.sh uploads the skill directory to the ClawHub registry using the publisher's own clawhub credentials. It is unnecessary for end users but harmless unless deliberately run; it does not read or forward user data. scripts/publish.sh:155 CMD=(clawhub publish "$SKILL_DIR" --version "$VERSION" --name "$NAME") |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| issuecdn.baidupcs.com | not in the service index | scripts/install.sh:9 |
| nodejs.org | not in the service index | scripts/memory-backup.sh:374 |
| openapi.baidu.com | not in the service index | reference/examples.md:211 |
| pan.baidu.com | not in the service index | SKILL.md:172 |
| Binaries invoked | bash, chmod, curl, git, node, nohup, python, rm -rf, sudo, wget |
| Environment variables read | AGENT_NAME, ANTHROPIC_API_KEY, AUTH_CODE, AUTH_URL, AUTO_YES, BACKUP_FILE, BASH_SOURCE, BDPAN_BIN, BDPAN_CONFIG_DIR, BDPAN_INSTALL_DIR, BDPAN_VERSION, BINARY_PATH, BLUE, CDN_BASE, CHANGELOG, CLAUDE_CODE, CLAUDE_SKILL_DIR, CMD, CONFIG_API, CONFIG_DIR, CYAN, DATE, DEFAULT_BASE_PATH, DEFAULT_CONFIG_DIR, DEFAULT_INSTALL_DIR, DEFAULT_NAME, EXIT_CODE, GREEN, HOME, INSTALL_DIR, MANIFEST_AGENT, MANIFEST_CREATED_AT, MANIFEST_DEVICE, MANIFEST_FILES, MANIFEST_MEMORY_SYSTEM, MANIFEST_VERSION, MCP_SERVER, MEMORY_DIR, MEMORY_SYSTEM_NAME, NAME, OPENCLAW_CLI, OPENCLAW_HOME, PATH, RED, REPLY, SCRIPT_DIR, SCRIPT_VERSION, SKILLS_INFO, SKILL_DIR, SKIP_CONFIRM, TMPDIR, VERSION, VERSION_FILE, WHOAMI, WORKSPACE_DIR, WORKSPACE_FILES, YELLOW |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 2 |
| base64 blobs | 0 |
| File writes | 20 |
| Persistence | 1 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 330 | 44791034954975af… |
_meta.json | 6 | 5e94727e8180006a… |
reference/authentication.md | 119 | 759276411a6cf237… |
reference/bdpan-commands.md | 673 | 7a85793795cc4f1b… |
reference/examples.md | 400 | 8b6258b15b3928af… |
reference/notes.md | 26 | effdfdc9aaf3faf5… |
reference/troubleshooting.md | 355 | 424147c7d3afc245… |
scripts/install.sh | 300 | 8aedee7bf48810a7… |
scripts/login.sh | 183 | f11bed956beba213… |
scripts/memory-backup.sh | 887 | 15ae73b4b63499dc… |
scripts/publish.sh | 173 | 8ccd00c5e129c5e0… |
scripts/uninstall.sh | 155 | 7620f20eff6b9920… |
scripts/update.sh | 374 | 7d324dfd8194e390… |
skill-card.md | 48 | 48ba605b4f878d65… |
For agents
JSON: https://agenteconomy.report/k/baidu-netdisk-skills.audit.json · badge: https://agenteconomy.report/k/baidu-netdisk-skills.audited.svg ·
skill rating: /k/baidu-netdisk-skills · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).