Nine Chinese cloud drives share one browser menu
LinkSwift is a userscript that adds download controls to Baidu Netdisk, Aliyun Drive, China Mobile Cloud, Tianyi Cloud, Thunder, Guangya, Quark, UC, and 123Pan pages. It obtains URLs through provider APIs, then lets the user copy them, download in the browser, or pass work to a configured download client. The project is aimed squarely at Chinese cloud-drive users.
The README and issue templates are Chinese, and the userscript metadata supplies Simplified and Traditional Chinese descriptions. We found no complete English guide. Someone comfortable reading source can still install it elsewhere, but provider names, settings, errors, and support discussions assume Chinese fluency. This language boundary belongs in the buying decision because failures often require reading the provider-specific report.
The script does not bypass provider throttling
The README states twice that LinkSwift uses public cloud-provider API interfaces and does not promise, market, or implement a speed-limit bypass. Faster transfers can result from provider policy, local network conditions, or temporary bandwidth decisions. That is a useful boundary: LinkSwift helps obtain and route a download URL; it does not control the account tier or service-side capacity behind that URL.
Version 1.1.3 added IDM client settings, adjusted link caching and notices, and updated Baidu share-page handling. Earlier entries mention Aria2, browser downloads, command copying, and other client integrations. Treat those as transport choices after extraction. If the provider declines a request, changes authentication, or returns a limited URL, swapping download managers cannot repair the upstream response.
What happened when we ran it
Our sandbox cloned commit 417ea5e into a fresh Debian container with 3 CPUs and 8 GB of RAM. Npm installed 76 packages in 8 seconds and used 13 MB. Npm audit reported 0 known vulnerabilities across that dependency tree. There was no build script or target, which fits a repository whose main artifact is a JavaScript userscript.
The test step failed after 4 seconds. Its entire meaningful output was the package script: echo "Error: no test specified" && exit 1. This is not a product regression found by a test. It is evidence that the project has no functioning npm test suite. Our scan also found 0 CI workflow files and no tests directory.
The checkout was small at 20 files, roughly 9,749 source lines, and 0.8 MB. Small does not make nine live integrations simple. Automated tests would need fixtures or controlled accounts for provider pages and APIs, while a user script also runs across browser and manager versions. In their absence, releases depend heavily on manual checks and user reports.
Broad permissions make source trust essential
The script runs at document-start across many authenticated drive domains. Its metadata requests unsafeWindow, cross-origin HTTP through GM_xmlhttpRequest, clipboard writes, local userscript storage, tab opening, menu registration, and @connect *. It also loads pinned jQuery, SweetAlert2, CSS, and MD5 assets from unpkg. Those capabilities explain how it reads page state and sends links to local or remote clients.
They also create a high-trust installation. A compromised update or dependency could observe page data or make network requests with the script's privileges. Install only from one of the sources the maintainer lists, inspect metadata changes before updating, and consider a separate browser profile used only for cloud downloads. The repository uses AGPL-3.0-or-later, so modified network-facing distributions also need license review.
Provider changes already break individual integrations
Open issue 472 says an August 2026 123Pan page update left the button visible on a share page but unable to read the selected file, while the home page showed no button. Issue 463 reports an error while reading selected files on China Mobile Cloud. Issue 466 says Thunder showed no download helper after selecting a file. These are three different providers and browser combinations.
That pattern is expected for a script coupled to third-party pages, but it changes how you should depend on it. LinkSwift is best treated as a convenience layer, not the only way to retrieve an urgent archive. Keep the official client available, avoid automatic canary updates on a critical profile, and report the browser, userscript manager, version, provider, and reproduction steps when something breaks.
Active maintenance has no automated safety net
GitHub showed 19,723 stars and 25 combined open issues and pull requests when fetched. The last push was August 5, 2026, and the newest issue activity continued through August 24. Release v1.1.3 dates to February 18, while the README also identifies a 1.1.3.1 preview line. The release tag is older than the last push, which is not evidence of abandonment.
LinkSwift solves a real irritation for users of several Chinese cloud drives, and the 0-vulnerability npm audit is preferable to an obviously neglected toolchain. The missing tests and broad privileges keep it out of managed enterprise browsers. For personal use, install from the documented source, read the permissions, keep an official fallback, and regard every provider fix as temporary until you test the current page yourself.