quark-download
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script fetches search results from
s.panhunt.comand performs resource validation via the official Quark domaindrive-pc.quark.cn. - [COMMAND_EXECUTION]: The skill operates by executing a local Python script (
quark_search.py) to handle API requests and communicate with the local Quark app. - [DATA_EXFILTRATION]: The script communicates with a local API service on
localhost:9128to trigger the Quark Desktop application's 'save' and 'info' functions. This is consistent with the skill's stated purpose of local app integration. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Data is ingested from the third-party PanSou API (
s.panhunt.com) during search operations inscripts/quark_search.py. - Boundary markers: No explicit boundary markers or 'ignore' instructions are used in the markdown when presenting search results (notes/titles) to the user.
- Capability inventory: The skill has the capability to trigger the local Quark application to open URLs and save resources via
localhost:9128. - Sanitization: The script implements sanitization for share IDs using a regular expression (
[a-zA-Z0-9]{6,32}) before passing data to the local application API, reducing the risk of command injection through the local port.
Audit Metadata