soia-pkm-alipan-drive-ops
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto interact with thealiyunpanCLI tool, which is necessary for its operation. Security is maintained by usingshell=Falseand a whitelist of allowed executable names (aliyunpan,aliyunpan.exe) in the wrapper scriptscripts/run_with_env.pyto prevent arbitrary command injection. - [CREDENTIALS_UNSAFE]: The skill documentation and code include explicit instructions and checks to prevent the printing or logging of sensitive credentials like tokens or cookies. It utilizes a private configuration file stored in
~/.config/soia-skills/to manage environment overrides, adhering to standard security practices for credential handling. - [SAFE]: The scanning logic in
scripts/scan_drive.pyimplements defensive checks for ambiguous file paths (multiple files/folders with the same name in one directory) and halts processing on such paths to avoid logic errors or data corruption, reflecting a security-conscious design.
Audit Metadata