Baidu Netdisk file management for OpenClaw - List, search, download, upload with OAuth 2.0 (百度网盘文件管理 - OAuth 一键授权)

This skill appears to implement Baidu Netdisk operations, but there are several mismatches you should consider before installing: - OAuth workflow: The documentation promises a one‑click OAuth via a provided enterprise app (no API application needed), but the code expects an API Key/Secret from config or environment. Expect you may need to supply your own Baidu API credentials for the auth flow to work. - Token encryption: Tokens are stored encrypted, but if you do not set ENCRYPTION_KEY the code derives the key from a hardcoded string. To avoid predictable encryption, set ENCRYPTION_KEY to a strong secret in your environment before authorizing. - Large files / streaming: The README claims streaming and zero local storage; the upload implementation reads the whole file into memory (fs.readFileSync), which can fail or OOM on large files. Treat the large‑file support claim as optimistic and test carefully. - Metadata mismatches: The published metadata says instruction‑only but the package contains runnable code/bin entries; confirm the source repository (links point to GitHub niukesi) and audit the code yourself if you have sensitive data. Recommended actions: - Inspect src/auth.js and src/baidu-api.js in the repo (they are present) to verify endpoints and keys. - Set ENCRYPTION_KEY env var to a strong secret before authorizing to avoid use of the built‑in key. - Prefer using your own Baidu API Key/Secret (via config or BAIDU_API_KEY/BAIDU_SECRET_KEY) rather than relying on any undocumented shared client_id. - Run the included test-local.sh in a controlled environment and monitor network traffic (mitmproxy) to confirm only pan.baidu.com/openapi.baidu.com are contacted. - Avoid installing on highly privileged hosts until you verify behavior (especially for large uploads). If you need higher assurance, ask the publisher for the exact enterprise client_id they claim to use, or audit/compile/install the package from the authoritative GitHub repo yourself.

Type: OpenClaw Skill Name: baidu-netdisk-skill Version: 1.0.10 The Baidu Netdisk skill bundle is a legitimate tool for managing cloud files via official Baidu APIs. It implements standard OAuth 2.0 flows and includes a security-conscious feature that encrypts sensitive Access and Refresh tokens locally using AES-256 (via `crypto-js`) before storing them in the user's config directory. Analysis of `src/baidu-api.js` and `src/auth.js` confirms that network requests are strictly limited to official domains (`pan.baidu.com` and `openapi.baidu.com`), and no evidence of data exfiltration, obfuscation, or malicious command execution was found.