While in Deathly Hallows, Xenophilius Lovegood describes the Hallows cloak as being inpenetrable in all ways; J.K. Rowling contradicts this in Tales of Beedle the Bard:
True Invisibility Cloaks, though rare, exist in this world of ours; however, the story
makes it clear that Death’s Cloak is of a uniquely durable nature.
Tales of Beedle the Bard - Page 96 - Bloomsbury - *The Tale of the Three Brothers
Invisibility Cloaks are not, generally, infallible. They may rip or grow opaque with age, of the charms placed upon them may wear off, or be countered by charms of revealment. This is why witches and wizards usually turn, in the first instance, to Disillusionment Charms for
self-camouflage or concealment. Albus Dumbledore was known to be able to perform a Disillusionment Charm so powerful as to render himself invisible without the need for a Cloak. [JKR]
Tales of Beedle the Bard - page 97 - Bloomsbury - The Tale of the Three Brothers
So, Death's cloak is thought to have been of a uniquely durable nature, which I take to mean stronger and perhaps more magical than, say, an Invisibility Cloak woven from Demiguise hair by the witch next door who likes knitting as a hobby. J.K. Rowling goes on to say that Invisibility Cloaks are not infallible -- generally. Yet Harry's cloak demonstrates it is not infallible on a few occasions. Quite frankly, this may be due to continuity errors. Or, perhaps, it's intentional and shows the audience the limitations of the Invisibility Cloak.
An example of why a Disillusionment Charm might be a better choice than an Invisibility Cloak in certain situations comes up in Order of the Phoenix:
‘Come here, boy,’ said Moody gruffly, beckoning Harry towards him with his wand. ‘I need to Disillusion you.’
‘You need to what?’ said Harry nervously.
‘Disillusionment Charm,’ said Moody, raising his wand. ‘Lupin says you’ve got an Invisibility Cloak, but it won’t stay on while we’re flying; this’ll disguise you better. Here you go –’
Order of the Phoenix - page 53 - Bloomsbury - chapter three, The Advance Guard
In Chamber of Secrets when Harry and Ron are hiding under the Invisibility Cloak in Hagrid's hut while Lucius Malfoy and Cornelius Fudge are there, Dumbledore successfully uses the Hominum Reveleo spell to detect Harry and Ron's presence.
‘However,’ said Dumbledore, speaking very slowly and clearly, so that none of them could miss a word, ‘you will find that I will only truly have left this school when none here are loyal to me. You will also find that help will always be given at Hogwarts to those who ask for it.’
For a second, Harry was almost sure Dumbledore’s eyes flickered towards the corner where he and Ron stood hidden.
Chamber of Secrets - page 195 - Bloomsbury - chapter fourteen, Cornelius Fudge
In Deathly Hallows, when Harry et al arrive at Gringott's to break into the Lestranges' vault, Harry seems to have reason to believe Probity-Probes would be able to detect him and Griphook under the Invisibility Cloak, and he stuns the goblin guards before they can use the Probity-Probes:
‘Ah, Probity Probes,’ sighed Travers theatrically, ‘so crude – but effective!’
And he set off up the steps, nodding left and right to the wizards, who raised the golden rods and passed them up and down his body. The Probes, Harry knew, detected spells of
concealment and hidden magical objects. Knowing that he had only seconds, Harry pointed Draco’s wand at each of the guards in turn and murmured, ‘Confundo,’ twice. Unnoticed by Travers, who was looking through the bronze doors at the inner hall, each of the guards gave a little start as the spells hit them.
Deathly Hallows - page 427 - Bloomsbury - chapter twenty-six, Gringott's
Invisibility Cloaks are not immune to all forms of magic. In Goblet of Fire, Harry discovers that Mad-Eye Moody's magical eye can see through Invisibility Cloaks.
Moody took a step closer to the foot of the stairs. Harry saw Moody’s magical eye travel over Snape, and then, unmistakeably, onto himself.
Harry’s heart gave a horrible jolt. Moody could see through Invisibility Cloaks ... he alone could see the full strangeness of the scene ... Snape in his nightshirt, Filch clutching the egg, and he, Harry, trapped in the stairs behind them. Moody’s lopsided
gash of a mouth opened in surprise. For a few seconds, he and Harry stared straight into each other’s eyes. Then Moody closed his mouth and turned his blue eye upon Snape
again.
Order of the Phoenix - page 409 - Bloomsbury - chapter twenty-five, The Egg and the Eye
I think it's interesting the cloak didn't respond to the Death Eaters' Accios in Hogsmeade in Deathly Hallows. Just because Xenophilius Lovegood believed the cloak to be infallible doesn't mean he was right. In fact, canon demonstrates in several places that Harry's cloak is not impervious. Draco Malfoy's Petrifcus Totalus worked on Harry through the Invisibility Cloak because Invisibility Cloaks are not infallible and can be penetrated by some forms of magic.
ETA: 4.2.14 - While researching another question, I found a passage in Deathly Hallows that explains if a person knows where another person who is hiding under an Invisibility Cloak is located, they may successfully cast magic upon the person hiding.
‘I could hardly believe what I was seeing. I asked to borrow [the Invisibility Cloak from James Potter], to examine it. I had long since given up my dream of uniting the Hallows, but I could not resist, could not help taking a closer look ... It was a Cloak the likes of which I had never seen, immensely old, perfect in every respect ... and then your father died, and I had two Hallows at last, all to
myself!’
His tone was unbearably bitter.
‘The Cloak wouldn’t have helped them survive, though,’ Harry said quickly. ‘Voldemort knew where my mum and dad were. The Cloak couldn’t have made them curse-proof.’
‘True,’ sighed Dumbledore. ‘True.’
Deathly Hallows - page 572-573 - Bloomsbury - chapter thirty-five, King's Cross
So, I amend my answer to: Draco Malfoy's Petrifcus Totalus worked on Harry through the Invisibility Cloak because Invisibility Cloaks are not infallible and can be penetrated by some forms of magic. Also, if a person hiding under an Invisibility Cloak's location is known, a witch or wizard can curse the person hiding. Draco Malfoy was able to curse Harry with Petrifcus Totalus because he knew exactly where Harry was, even though Harry was wearing his Invisibility Cloak.
Hopefully these two canon-based explanations regarding the Invisibility Cloak -- the reliability of the Invisibility Cloak and the issue of the location of the person wearing the Cloak -- sufficiently answers this question.