quarkclouddrive

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's installation script fetches configuration and updates from the official vendor domain (open-api-drive.quark.cn) and utilizes well-known repositories (nodesource.com) for managing its Node.js environment. These are legitimate resources associated with the skill's primary functionality.- [REMOTE_CODE_EXECUTION]: The installation process involves downloading and executing setup scripts and zip packages from trusted vendor and technology provider sources. This is a standard mechanism for delivering and updating the skill's CLI components.- [COMMAND_EXECUTION]: Operation is conducted through a local CLI tool and shell scripts. This architecture is necessary for the skill to interact with the system environment and the cloud drive API.- [INDIRECT_PROMPT_INJECTION]: As the skill handles external files and sharing URLs, it has an inherent surface for indirect prompt injection. However, the instructions provide specific rules for processing this data through a dedicated AI Assistant and mandating the display of original service notices, which effectively mitigates the risk of the agent being misled by adversarial content.- [PRIVILEGE_ESCALATION]: The use of sudo within the installation script is strictly limited to the management of system-level dependencies required for the Node.js runtime, which is a common and necessary practice for environment setup.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:11 PM