Bili Rs

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:35 AM UTC
• Version: 1.0.1

Overview

This is a project-specific development guide for a Bilibili Rust CLI, with sensitive account features documented but no hidden execution or unsafe install behavior in the skill itself.

Install only if you are working on the bili-rs Bilibili CLI. Treat commands that read history or change account state as sensitive, and require explicit user intent before implementing or running posting, deletion, follow, like, coin, or credential-related flows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

- `Read` — requires SESSDATA
- `Write` — requires SESSDATA + bili_jct

Credential file: `~/.bilibili-cli/credential.json` (0o600, 7-day TTL)

## WBI Signature

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use the skill when implementing features, fixing bugs, or extending the codebase, and lists broad task categories like adding CLI commands or handling authentication. For a markdown skill file, this is an ambiguous activation scope because it does not define explicit trigger phrases, exclusions, or negative examples to distinguish when the skill should or should not activate.

Session Persistence

Medium

• Category: Rogue Agent

Content

# bili-rs Development Skill

Rust rewrite of [bilibili-cli](https://github.com/jackwener/bilibili-cli). Single binary, no runtime deps. Full feature parity with the Python original.

## Architecture (strict layering)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly enumerates authenticated write/destructive API operations such as posting dynamics, deleting dynamics, modifying relations, and liking/coining videos, but provides no safety notes about account-impacting behavior, confirmation requirements, or the need to avoid invoking such endpoints automatically. In an agent skill context, this increases the chance that an automated coding or execution workflow will implement or trigger state-changing actions without sufficient user awareness or guardrails.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file documents `bili login` as `QR scan → save credential`, which indicates persistent storage of authentication material. The description does not include any warning about where credentials are stored, their persistence, or the privacy/security implications of saving them locally.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `bili dynamic-post` creates account content, which can affect the user's public profile or followers. The reference states the syntax but does not warn that this is a write action with user-visible consequences, unlike neighboring destructive commands that explicitly mention confirmation behavior.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The markdown advertises `bili history` as returning watch history, which is user-sensitive behavioral data. There is no accompanying warning that invoking this command may reveal private account activity or should be used cautiously in shared/logged environments.

Static analysis

No suspicious patterns detected.