cloud-storage
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests file metadata and directory structures from external cloud storage APIs, creating a surface for potential indirect instructions.\n
- Ingestion points: Data is retrieved from Baidu and Quark APIs during file listing and status check operations (e.g., Baidu's list and quota methods).\n
- Boundary markers: The instructions do not define clear delimiters or use boundary markers to distinguish between data and instructions when processing API responses.\n
- Capability inventory: The skill makes use of network operations via curl, shell execution for CLI tools, and local script execution for token management.\n
- Sanitization: No validation or sanitization logic is provided for external file names or metadata received from the cloud providers.\n- [EXTERNAL_DOWNLOADS]: The documentation instructs the user or agent to install the quarkpan package from PyPI, which is a well-known and standard package registry for Python.\n- [COMMAND_EXECUTION]: The skill uses various shell commands and CLI tools (curl, python3, quarkpan) to perform DevOps tasks such as managing cloud storage authentication, manipulating files, and refreshing access tokens.
Audit Metadata